The vulnerability CVE-2026-23383 in the Linux kernel affects the BPF JIT allocator on arm64 platforms. The struct bpf_plt contains a 64-bit target field that must be 8-byte aligned for atomic operations. However, the JIT buffer was allocated with only 4-byte alignment, allowing the target field to be misaligned. This misalignment can cause torn reads during concurrent updates via WRITE_ONCE() while the JIT code executes, potentially leading to jumps to corrupted addresses. The fix increases the JIT buffer alignment to 8 bytes, ensuring atomicity and preventing this issue. The vulnerability is addressed in Linux kernel versions 6.8.0 and later, with patches available in Ubuntu kernel updates as per the vendor advisory.

Exploitation of this vulnerability could cause the JIT-compiled BPF code on arm64 to jump to corrupted addresses due to torn reads of a misaligned 64-bit target field. This can lead to arbitrary code execution or system compromise with high confidentiality, integrity, and availability impact. The CVSS v3.1 score is 7.8 (high), reflecting the potential for significant system compromise by a local attacker with low privileges.

A patch is available and has been released in updated Linux kernel versions including those distributed by Ubuntu. Users should update their Linux kernel to version 6.8.0 or later (or the corresponding patched package versions) and reboot the system to apply the fix. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. No additional mitigations are specified beyond applying the official patch.