CVE-2026-23383: Linux Kernel Race Condition Vulnerability

CVE-2026-23383 Overview

A memory alignment vulnerability has been identified in the Linux kernel's BPF (Berkeley Packet Filter) JIT (Just-In-Time) compiler for ARM64 architecture. The vulnerability exists in the JIT buffer allocation mechanism, where the struct bpf_plt contains a u64 target field that may not be properly aligned to an 8-byte boundary.

The BPF JIT allocator currently requests only 4-byte alignment (sizeof(u32)) for the JIT buffer. When the base address of the JIT buffer is 4-byte aligned (e.g., ending in 0x4 or 0xc), the relative padding logic in build_plt() fails to ensure that the target field lands on an 8-byte boundary. This misalignment can lead to atomic tearing during concurrent memory operations.

Critical Impact

This vulnerability can cause the JIT compiler to jump to a corrupted address due to torn reads during concurrent 64-bit load/store operations, potentially leading to system instability or unpredictable behavior.

Affected Products

• Linux Kernel (ARM64 architecture with BPF JIT enabled)
• Systems utilizing BPF programs with ARM64 JIT compilation
• Linux distributions running affected kernel versions on ARM64 hardware

Discovery Timeline

• 2026-03-25 - CVE CVE-2026-23383 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-23383

Vulnerability Analysis

This vulnerability stems from a race condition combined with improper memory alignment in the ARM64 BPF JIT compiler. The core issue involves how the target field within struct bpf_plt is accessed concurrently by multiple operations.

The target field is a 64-bit value (u64) that is updated via WRITE_ONCE() in the bpf_arch_text_poke() function while JIT-compiled code simultaneously executes ldr (load register) instructions. On ARM64 architecture, 64-bit loads and stores are only guaranteed to be single-copy atomic when they are properly 64-bit aligned.

When the JIT buffer base address falls on a 4-byte boundary that is not also an 8-byte boundary, the target field becomes misaligned. This misalignment creates a scenario where:

1. UBSAN (Undefined Behavior Sanitizer) reports misaligned-access warnings when dereferencing the structure
2. A torn read can occur, where the processor reads partial data from two separate memory operations, resulting in a corrupted address value

If a torn read occurs during JIT execution, the processor may attempt to jump to an invalid or corrupted memory address, potentially causing system crashes, kernel panics, or unpredictable behavior.

Root Cause

The root cause is insufficient alignment requirements in the bpf_jit_binary_pack_alloc() function. The allocator requests only 4-byte alignment (sizeof(u32)) when the data structures being allocated contain 64-bit fields that require 8-byte alignment for atomic operation guarantees on ARM64.

The build_plt() function's relative padding logic assumes the base address will provide proper alignment, but this assumption fails when the base is only 4-byte aligned.

Attack Vector

This vulnerability manifests through the combination of concurrent BPF JIT operations on ARM64 systems. The conditions for exploitation include:

• Active BPF program execution using JIT-compiled code
• Concurrent modification of BPF program trampolines via bpf_arch_text_poke()
• JIT buffer allocation that happens to fall on a 4-byte but not 8-byte aligned address

While this is primarily a reliability and stability issue, the potential for jumping to corrupted addresses could theoretically be leveraged in sophisticated attack scenarios where an attacker can influence memory layout and timing of concurrent operations.

Detection Methods for CVE-2026-23383

Indicators of Compromise

• UBSAN warnings in kernel logs indicating misaligned-access for BPF-related structures
• Unexpected kernel crashes or panics during BPF program execution on ARM64 systems
• Anomalous behavior in applications utilizing BPF programs on ARM64 hardware
• System instability correlated with BPF JIT activity in dmesg or system logs

Detection Strategies

• Enable UBSAN in the kernel configuration to detect misaligned memory accesses (CONFIG_UBSAN_ALIGNMENT=y)
• Monitor system logs for BPF-related panics or UBSAN warnings using centralized log analysis
• Implement kernel tracing with ftrace or perf to monitor bpf_arch_text_poke() operations
• Deploy SentinelOne's kernel-level monitoring to detect anomalous JIT behavior patterns

Monitoring Recommendations

• Configure alerting for kernel panics and UBSAN warnings on ARM64 systems
• Track BPF program loading and JIT compilation events across your ARM64 fleet
• Establish baseline behavior for BPF operations to identify deviations
• Use SentinelOne's deep visibility features to monitor kernel-level operations and detect potential exploitation attempts

How to Mitigate CVE-2026-23383

Immediate Actions Required

• Apply the kernel patches referenced in the official git commits to production systems
• Prioritize patching ARM64 systems that actively utilize BPF programs
• Consider temporarily disabling BPF JIT on ARM64 systems if immediate patching is not feasible (net.core.bpf_jit_enable=0)
• Review system logs for any evidence of prior exploitation or instability related to this vulnerability

Patch Information

The fix increases the allocation alignment requirement to 8 bytes (sizeof(u64)) in the bpf_jit_binary_pack_alloc() function. This ensures the JIT buffer base is anchored to an 8-byte boundary, allowing the relative padding logic in build_plt() to correctly align the target field.

The following kernel commits contain the fix:

• Kernel Git Commit 519b1ad9
• Kernel Git Commit 66959ed4
• Kernel Git Commit 80ad264d
• Kernel Git Commit ef06fd16

Workarounds

• Disable BPF JIT compilation on ARM64 systems by setting net.core.bpf_jit_enable=0 via sysctl
• If BPF functionality is required, consider using BPF interpreter mode until patches can be applied
• Limit the deployment of new BPF programs on unpatched ARM64 systems
• Implement additional monitoring for affected systems to detect potential issues before patches are deployed

# Configuration example
# Disable BPF JIT on ARM64 as a temporary workaround
echo 0 | sudo tee /proc/sys/net/core/bpf_jit_enable

# Make the change persistent across reboots
echo "net.core.bpf_jit_enable = 0" | sudo tee -a /etc/sysctl.d/99-disable-bpf-jit.conf
sudo sysctl --system

# Verify the setting is applied
sysctl net.core.bpf_jit_enable