CVE-2026-23417: Linux Kernel Privilege Escalation Flaw

CVE-2026-23417 Overview

A vulnerability has been identified in the Linux kernel's BPF (Berkeley Packet Filter) subsystem related to constant blinding for PROBE_MEM32 stores. The bpf_jit_blind_insn() function fails to properly handle BPF_ST | BPF_PROBE_MEM32 immediate stores, allowing user-controlled 32-bit immediates to survive unblinded into JIT-compiled native code when bpf_jit_harden >= 1. This bypass of the constant blinding security mechanism could potentially be leveraged by attackers with BPF program loading capabilities.

Critical Impact

User-controlled 32-bit immediates can bypass constant blinding protections and persist in JIT-compiled native code, potentially enabling JIT spray attacks or other exploitation techniques against hardened BPF environments.

Affected Products

• Linux kernel with BPF JIT compilation enabled
• Systems with bpf_jit_harden set to 1 or higher
• Linux kernel versions prior to the security patches

Discovery Timeline

• April 2, 2026 - CVE-2026-23417 published to NVD
• April 2, 2026 - Last updated in NVD database

Technical Details for CVE-2026-23417

Vulnerability Analysis

The vulnerability exists in the BPF JIT constant blinding mechanism, a security feature designed to prevent JIT spray attacks by obfuscating immediate values in BPF programs before they are compiled to native machine code. The constant blinding feature is activated when bpf_jit_harden is set to 1 or higher.

The flaw occurs because the convert_ctx_accesses() function rewrites BPF_ST|BPF_MEM instructions to BPF_ST|BPF_PROBE_MEM32 for arena pointer stores during the verification phase, which happens before bpf_jit_blind_constants() runs during JIT compilation. The blinding switch statement in bpf_jit_blind_insn() only matches BPF_ST|BPF_MEM (mode 0x60) and does not account for BPF_ST|BPF_PROBE_MEM32 (mode 0xa0), causing these instructions to fall through unblinded.

This means that when an attacker crafts a BPF program with specific immediate values targeting arena pointer stores, those values will remain unchanged in the final JIT-compiled code, defeating the purpose of constant blinding and potentially enabling JIT spray or gadget injection attacks.

Root Cause

The root cause is an incomplete implementation in the bpf_jit_blind_insn() function that fails to handle all instruction modes that can carry user-controlled immediate values. Specifically, when convert_ctx_accesses() transforms BPF_ST|BPF_MEM instructions to BPF_ST|BPF_PROBE_MEM32 for arena pointer stores during verification, the subsequent constant blinding pass does not recognize these transformed instructions as requiring blinding treatment. The timing of these operations—verification before JIT compilation—creates a window where the instruction mode changes but the blinding logic is never updated to match.

Attack Vector

An attacker with the ability to load BPF programs (typically requiring CAP_BPF or CAP_SYS_ADMIN capabilities, or unprivileged BPF access if enabled) could craft a malicious BPF program containing specific immediate values in arena pointer store operations. When the program is JIT-compiled on a system with bpf_jit_harden >= 1, these immediates would bypass the constant blinding protection and appear unobfuscated in the generated native code. This could be used as a building block for JIT spray attacks to place attacker-controlled data at predictable memory locations, potentially aiding in exploitation of other vulnerabilities.

The attack requires local access and BPF program loading privileges. The vulnerability specifically targets the arena memory addressing functionality used with BPF arena pointers, which relies on R12-based addressing on x86-64 architectures.

Detection Methods for CVE-2026-23417

Indicators of Compromise

• Unusual BPF program loads targeting arena memory operations
• BPF programs with suspicious immediate values in PROBE_MEM32 store instructions
• Unexpected patterns in JIT-compiled BPF code on systems with hardening enabled

Detection Strategies

• Monitor BPF program loading events via the bpf() syscall audit logs
• Implement kernel-level monitoring for BPF program verification and JIT compilation events
• Review system logs for unusual BPF-related activity from non-privileged processes
• Deploy security tools capable of analyzing BPF program bytecode before JIT compilation

Monitoring Recommendations

• Enable BPF audit logging to track program loads and their sources
• Monitor for processes attempting to load BPF programs that utilize arena pointer functionality
• Implement runtime integrity checking on JIT-compiled BPF code when hardening is enabled
• Track changes to bpf_jit_harden sysctl settings

How to Mitigate CVE-2026-23417

Immediate Actions Required

• Apply the kernel patches from the official kernel git repository
• Restrict BPF program loading to trusted users by ensuring kernel.unprivileged_bpf_disabled=1
• Review and audit any custom BPF programs deployed in your environment
• Consider temporarily disabling BPF JIT compilation if patches cannot be immediately applied

Patch Information

The fix has been committed to the stable kernel branches and adds BPF_ST|BPF_PROBE_MEM32 cases to bpf_jit_blind_insn() alongside the existing BPF_ST|BPF_MEM cases. The blinding transformation loads the blinded immediate into BPF_REG_AX via mov+xor operations, then converts the immediate store to a register store (BPF_STX). The rewritten STX instruction preserves the BPF_PROBE_MEM32 mode to ensure the architecture JIT emits correct arena addressing.

Patches are available at:

• Kernel Git Commit 2321a959
• Kernel Git Commit 56af7227
• Kernel Git Commit ccbf29b2
• Kernel Git Commit de641ea0

Workarounds

• Disable BPF JIT compilation by setting net.core.bpf_jit_enable=0 (impacts performance)
• Ensure unprivileged BPF is disabled: sysctl kernel.unprivileged_bpf_disabled=1
• Restrict CAP_BPF and CAP_SYS_ADMIN capabilities to only essential services and users
• Consider using seccomp filters to restrict access to the bpf() syscall for untrusted processes

# Configuration example
# Disable unprivileged BPF access (recommended)
echo 1 > /proc/sys/kernel/unprivileged_bpf_disabled

# Alternative: Disable BPF JIT entirely (performance impact)
echo 0 > /proc/sys/net/core/bpf_jit_enable

# Make settings persistent via sysctl.conf
echo "kernel.unprivileged_bpf_disabled = 1" >> /etc/sysctl.conf
sysctl -p