CVE-2026-23383: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23383 Overview

CVE-2026-23383 is a memory alignment vulnerability in the Linux kernel's arm64 BPF Just-In-Time (JIT) compiler. The BPF JIT allocator requests 4-byte alignment for the JIT buffer, but the struct bpf_plt contains a u64 target field requiring 8-byte alignment for atomic access. On arm64, 64-bit loads and stores are only guaranteed to be single-copy atomic when 64-bit aligned. A misaligned target field risks a torn read during concurrent updates via WRITE_ONCE() in bpf_arch_text_poke(), causing the JIT'd code to jump to a corrupted address.

Critical Impact
Torn atomic reads on misaligned bpf_plt target fields can cause the kernel BPF JIT to dispatch execution to a corrupted memory address, leading to kernel instability or potential exploitation.

Affected Products

Linux Kernel 6.0 (release)
Linux Kernel 7.0 release candidates (rc1 through rc7)
Linux Kernel branches prior to the patched commits on arm64 architectures with BPF JIT enabled

Discovery Timeline

2026-03-25 - CVE-2026-23383 published to NVD
2026-04-24 - Last updated in NVD database

Technical Details for CVE-2026-23383

Vulnerability Analysis

The vulnerability resides in the arm64 BPF JIT compiler subsystem within the Linux kernel. The struct bpf_plt structure contains a u64 target field used as a procedure linkage table entry for BPF programs. The JIT allocator, via bpf_jit_binary_pack_alloc(), requests buffer alignment of sizeof(u32), which equals 4 bytes.

Because the base address of the JIT buffer may be 4-byte aligned and end in 0x4 or 0xc, the relative padding logic in build_plt() cannot reliably place the target field on an 8-byte boundary. This produces two distinct failure modes. First, the Undefined Behavior Sanitizer (UBSAN) reports misaligned-access warnings when code dereferences the structure. Second, and more severely, the target field is updated concurrently through WRITE_ONCE() in bpf_arch_text_poke() while executing JIT code performs an ldr instruction against it.

On arm64, the architecture only guarantees single-copy atomicity for 64-bit loads and stores when the access is 64-bit aligned. A misaligned target therefore risks a torn read, splitting the 8-byte value across two non-atomic memory transactions.

Root Cause

The root cause is an insufficient alignment requirement in the BPF JIT binary allocator. Requesting only 4-byte alignment violates the implicit 8-byte alignment requirement of the u64 target field within struct bpf_plt, creating a race condition window for atomicity violations on arm64.

Attack Vector

Exploitation requires local access with privileges sufficient to load or trigger BPF program JIT compilation on an arm64 system. An attacker capable of inducing concurrent text patching via bpf_arch_text_poke() while a JIT'd program executes can trigger a torn read of the target pointer. The resulting corrupted address causes the kernel to branch to an unintended location, producing kernel instability or potentially enabling control-flow corruption.

No public proof-of-concept exploit is currently available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details are described in prose only; refer to the upstream commits for the corrective patch implementation.

Detection Methods for CVE-2026-23383

Indicators of Compromise

UBSAN kernel log messages reporting misaligned access warnings referencing bpf_plt or BPF JIT code paths on arm64 systems
Unexplained kernel oopses or panics originating from JIT'd BPF program execution, particularly involving invalid instruction addresses
Soft lockups or branches to non-canonical addresses traced back to BPF JIT trampoline regions

Detection Strategies

Monitor kernel ring buffer output (dmesg) for UBSAN reports tagged with alignment violations in BPF subsystem functions
Audit running kernel version against the fixed commits referenced in the upstream advisories on git.kernel.org
Correlate kernel crash telemetry with workloads that load BPF programs and use text poking, such as tracing or networking eBPF tools

Monitoring Recommendations

Enable CONFIG_UBSAN and CONFIG_UBSAN_ALIGNMENT on test arm64 kernels to surface alignment violations before production deployment
Collect and centralize kernel logs from arm64 hosts that run eBPF workloads to identify recurring JIT-related faults
Track BPF program load activity through audit subsystem records to identify unexpected privileged users invoking JIT compilation

How to Mitigate CVE-2026-23383

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the vendor advisories to all affected arm64 systems running BPF JIT
Inventory arm64 hosts running Linux kernel 6.0 or 7.0 release candidates and prioritize patching for those exposed to untrusted BPF program loaders
Restrict unprivileged BPF usage by setting kernel.unprivileged_bpf_disabled=1 until patches are deployed

Patch Information

The fix increases the allocation alignment requirement to 8 bytes (sizeof(u64)) in bpf_jit_binary_pack_alloc(). This anchors the JIT buffer base to an 8-byte boundary, allowing the relative padding logic in build_plt() to correctly align the target field. The corrective commits are available at Kernel Git Commit 519b1ad, Kernel Git Commit 66959ed, Kernel Git Commit 80ad264, and Kernel Git Commit ef06fd1.

Workarounds

Disable unprivileged BPF program loading via sysctl kernel.unprivileged_bpf_disabled=1 to reduce the attack surface
Disable the BPF JIT entirely on arm64 systems where interpreter mode is acceptable by setting net.core.bpf_jit_enable=0
Limit CAP_BPF and CAP_SYS_ADMIN capabilities to trusted service accounts and containers only

bash

# Configuration example
sysctl -w kernel.unprivileged_bpf_disabled=1
sysctl -w net.core.bpf_jit_enable=0
echo 'kernel.unprivileged_bpf_disabled=1' >> /etc/sysctl.d/99-bpf-hardening.conf
echo 'net.core.bpf_jit_enable=0' >> /etc/sysctl.d/99-bpf-hardening.conf