CVE-2026-68295: Linux Kernel LoongArch BPF Vulnerability

CVE-2026-68295 Overview

CVE-2026-68295 affects the Linux kernel's LoongArch Berkeley Packet Filter (BPF) Just-In-Time (JIT) compiler. The JIT sign-extends the result of signed ALU32 BPF_DIV and BPF_MOD operations (with off=1), leaving bits 63:32 set when the 32-bit quotient or remainder is negative. The BPF verifier and interpreter model those upper bits as zero, creating a divergence between JITted code behavior and the verifier's abstract state.

This inconsistency allows local users with the ability to load BPF programs on LoongArch systems to trigger register state mismatches. The kernel has published a fix in the LoongArch JIT that zero-extends the ALU32 result after divide or modulo instructions.

Critical Impact
Local unprivileged BPF program loaders on LoongArch can obtain register values that diverge from what the BPF verifier accepted, potentially bypassing verifier safety guarantees.

Affected Products

Linux kernel with LoongArch BPF JIT enabled
LoongArch architecture kernels compiled with CONFIG_BPF_JIT
Stable kernel branches prior to the fix commits 716cb29d and dacd348b

Discovery Timeline

2026-08-10 - CVE-2026-68295 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68295

Vulnerability Analysis

BPF ALU32 operations are defined to write a 32-bit result and clear the upper 32 bits of the destination BPF register. The LoongArch JIT correctly implements this contract for most ALU32 operations, including unsigned divide and modulo. However, the code path for signed BPF_DIV and BPF_MOD with off=1 sign-extends the result rather than zero-extending it.

When a signed 32-bit divide or modulo produces a negative value, the JITted instruction sequence leaves bits 63:32 populated with the sign bit. Downstream instructions then operate on a 64-bit register whose upper half is nonzero, while the verifier's static analysis assumed those bits were cleared. This breaks an invariant the BPF verifier relies on when proving bounded pointer arithmetic and safe memory access.

Root Cause

The root cause is a sign extension error in the LoongArch JIT backend for signed ALU32 division and modulo. The JIT must retain sign-extended operands to feed the signed divide instruction, but it must then zero-extend the 32-bit result before writing back to the BPF register. The vulnerable code omits that final zero-extension step, mismatching the semantics that every other ALU32 operation in the JIT observes.

Attack Vector

A local user who can load BPF programs, either through bpf(2) with CAP_BPF or through unprivileged BPF where enabled, can craft a program that uses signed ALU32 divide or modulo to produce a negative result. The verifier accepts the program under the assumption that the upper register bits are zero. The JITted code then computes a value with tainted upper bits and uses it as an index or offset, potentially escaping verifier-enforced bounds. This vector is limited to LoongArch systems and requires local access.

See the upstream fixes in Kernel Git Commit 716cb29d and Kernel Git Commit dacd348b for the exact JIT emitter changes.

Detection Methods for CVE-2026-68295

Indicators of Compromise

Unexpected BPF program loads from unprivileged users on LoongArch hosts running bpf(2) syscalls with signed ALU32 opcodes.
Kernel oops or memory access anomalies traced back to a JITted BPF program on LoongArch.
Presence of the vulnerable JIT emitter code paths in arch/loongarch/net/bpf_jit.c prior to the fix commits.

Detection Strategies

Audit installed kernel versions on LoongArch endpoints and compare against the fixed commits 716cb29d and dacd348b.
Monitor bpf(2) syscall telemetry for programs originating from non-root users, particularly on LoongArch hardware.
Review kernel build configuration to identify systems with CONFIG_BPF_JIT=y on LoongArch.

Monitoring Recommendations

Enable auditd rules for bpf syscalls and record the calling UID and program type.
Correlate kernel warnings referencing the BPF verifier or JIT with recent unprivileged process activity.
Track deployment of stable kernel updates across the LoongArch fleet to confirm patch coverage.

How to Mitigate CVE-2026-68295

Immediate Actions Required

Update the Linux kernel on all LoongArch systems to a stable release containing commits 716cb29d and dacd348b.
Restrict BPF program loading to trusted users by setting kernel.unprivileged_bpf_disabled=1 where operational requirements allow.
Inventory LoongArch systems in the environment and prioritize patching for multi-tenant or shared-access hosts.

Patch Information

The fix keeps sign-extension on the operands passed to the signed divide instruction and adds a zero-extension of the ALU32 result after the divide or modulo, matching the unsigned ALU32 div/mod paths and every other ALU32 operation in the LoongArch JIT. Apply the upstream stable commits 716cb29d and dacd348b, or install a distribution kernel that incorporates them.

Workarounds

Set kernel.unprivileged_bpf_disabled=1 via sysctl to prevent unprivileged users from loading BPF programs.
Disable the BPF JIT on LoongArch with net.core.bpf_jit_enable=0 to force interpreter execution, accepting a performance cost.
Remove CAP_BPF from non-administrative users and service accounts where feasible.

bash

# Configuration example
sysctl -w kernel.unprivileged_bpf_disabled=1
sysctl -w net.core.bpf_jit_enable=0
echo 'kernel.unprivileged_bpf_disabled=1' >> /etc/sysctl.d/99-bpf-hardening.conf
echo 'net.core.bpf_jit_enable=0' >> /etc/sysctl.d/99-bpf-hardening.conf