CVE-2026-68285: Linux Kernel BPF Memory Leak Vulnerability

CVE-2026-68285 Overview

CVE-2026-68285 is a memory leak vulnerability in the Linux kernel's LoongArch Berkeley Packet Filter (BPF) Just-In-Time (JIT) compiler. The flaw resides in the bpf_jit_free() function, which fails to release the jit_data->ctx.offset array when JIT compilation aborts for a subprogram. Each failed compilation leaks kernel memory allocated by the JIT context offsets array. The issue affects Linux kernel builds running on LoongArch 64-bit systems that use BPF subprograms. Kernel maintainers have merged a fix that adds the missing kvfree() call in the cleanup path.

Critical Impact
Repeated BPF subprogram compilation failures on LoongArch systems can exhaust kernel memory over time, degrading system stability.

Affected Products

Linux kernel on LoongArch 64-bit architecture
Kernel builds with CONFIG_BPF_JIT enabled
Systems executing BPF programs containing subprograms (bpf-to-bpf calls)

Discovery Timeline

2026-08-10 - CVE-2026-68285 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68285

Vulnerability Analysis

The defect exists in the LoongArch BPF JIT compiler's cleanup logic. When bpf_int_jit_compile() handles subprograms, it exits early during the first pass while !prog->is_func || extra_pass evaluates to false. The function intentionally preserves ctx->offset so that a subsequent extra pass can reuse the computed instruction offsets. This deferred cleanup design assumes the extra pass will eventually run and free the state.

When JIT compilation fails for a later subprogram in the same program, the BPF core aborts the whole operation. It then calls bpf_jit_free() on already-processed subprograms to release their state. The LoongArch implementation of bpf_jit_free() released other JIT data structures but omitted the jit_data->ctx.offset array. Every aborted compilation therefore leaks the offsets allocation until reboot.

The vulnerability is classified as a Memory Leak [CWE-401]. Exploitation requires local ability to load BPF programs, typically privileged capability CAP_BPF or CAP_SYS_ADMIN. The primary consequence is kernel memory exhaustion under sustained failure conditions.

Root Cause

The bpf_jit_free() function on LoongArch did not mirror the allocation performed during the first compilation pass. Because ctx->offset is deliberately kept alive across passes, the cleanup path must explicitly reclaim it when the extra pass never executes. The missing kvfree(jit_data->ctx.offset) call left the buffer orphaned.

Attack Vector

A local user with BPF-loading privileges can trigger the leak by submitting BPF programs containing subprograms designed to fail JIT compilation on a later function. Repeated invocations accumulate leaked memory in kernel address space. The vulnerability does not permit code execution or privilege escalation. See the Linux Kernel Commit Fix for the applied patch.

Detection Methods for CVE-2026-68285

Indicators of Compromise

Steady growth in kernel slab or kvmalloc allocations on LoongArch hosts without matching workload increase
Repeated bpf() syscall failures with EINVAL or ENOTSUPP from subprogram-heavy loaders
Unexplained reduction in MemAvailable reported by /proc/meminfo on long-running LoongArch servers

Detection Strategies

Audit bpf() syscall telemetry to identify users repeatedly loading programs that fail JIT compilation
Monitor kernel memory accounting via /proc/slabinfo and kmemleak reports for growth tied to BPF JIT allocations
Correlate BPF program load failures with LoongArch kernel builds running unpatched revisions

Monitoring Recommendations

Enable CONFIG_DEBUG_KMEMLEAK in test environments to surface unfreed JIT context allocations
Track kernel version inventory across LoongArch fleets and flag hosts running pre-patch builds
Alert on processes making high-frequency BPF_PROG_LOAD calls with elevated failure ratios

How to Mitigate CVE-2026-68285

Immediate Actions Required

Apply the upstream Linux kernel patch that adds kvfree(jit_data->ctx.offset) to bpf_jit_free() on LoongArch
Restrict BPF program loading to trusted users by tightening kernel.unprivileged_bpf_disabled sysctl settings
Reboot affected LoongArch systems that have accumulated leaked memory from prior BPF failures

Patch Information

The fix is available in the mainline and stable Linux kernel trees. Reference the Linux Kernel Commit Changes and the Linux Kernel Commit Fixes for the exact code changes. Distribution vendors shipping LoongArch kernels should backport the change to their supported branches.

Workarounds

Set kernel.unprivileged_bpf_disabled=1 to block unprivileged BPF program loading
Disable the BPF JIT with sysctl -w net.core.bpf_jit_enable=0 where interpreter fallback is acceptable
Limit CAP_BPF and CAP_SYS_ADMIN capabilities to essential service accounts on LoongArch hosts

bash

# Configuration example
sysctl -w kernel.unprivileged_bpf_disabled=1
sysctl -w net.core.bpf_jit_enable=0
echo 'kernel.unprivileged_bpf_disabled=1' >> /etc/sysctl.d/90-bpf-hardening.conf