CVE-2026-89902 Overview
CVE-2026-89902 is a Linux kernel vulnerability affecting the LoongArch architecture's Kprobes implementation. The kernel uses break 11 as the breakpoint instruction placed after an out-of-line executed instruction. Because userspace can issue the same break 11 instruction, the do_bp() handler can reach kprobe_singlestep_handler() even when no active probe exists. The handler calls preempt_enable_no_resched() without a matching preempt_disable(), causing a preempt count underflow. This underflow makes in_interrupt() return true until the task schedules, which affects socket cgroup attribution and can allow a task to bypass a BPF_CGROUP_INET_SOCK_CREATE policy attached to its own cgroup.
Critical Impact
A local unprivileged user on LoongArch systems can trigger a preempt count underflow via a userspace break 11 instruction, evading BPF cgroup socket-creation policies.
Affected Products
- Linux kernel on the LoongArch architecture
- Kernel builds with CONFIG_KPROBES enabled
- Stable branches referenced in commits 72ce4b2, 7639510, a1cb727, c4357eb, and ff40e59
Discovery Timeline
- 2026-09-16 - CVE-2026-89902 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89902
Vulnerability Analysis
The flaw lives in the LoongArch breakpoint dispatch path used by Kprobes. Kprobes single-step handling relies on a matched pair of preempt_disable() and preempt_enable_no_resched() calls. kprobe_breakpoint_handler() performs the disable on a genuine probe hit, and kprobe_singlestep_handler() performs the enable when execution returns from the out-of-line slot.
Because break 11 is a valid userspace instruction, an unprivileged process can execute it and enter do_bp() directly. Control reaches kprobe_singlestep_handler() even though no matching preempt_disable() was ever executed. The handler decrements the preempt counter before returning false, driving the current task's counter below zero.
Once the counter underflows, in_interrupt() returns true until the next reschedule. Kernel code paths that branch on interrupt context then behave incorrectly. cgroup_sk_alloc() treats the socket allocation as if it originated from interrupt context and assigns the new socket to the root cgroup rather than the task's cgroup. Any BPF_CGROUP_INET_SOCK_CREATE program attached to the task's own cgroup is skipped for that socket.
Root Cause
The root cause is a missing early return in the LoongArch kprobe_singlestep_handler(). The same guard existed in v10 of the original LoongArch Kprobes series but was dropped before mainline merge. Without it, the handler cannot distinguish a legitimate single-step exit from a userspace-issued break 11.
Attack Vector
Exploitation requires only local code execution as an unprivileged user on a LoongArch host. The attacker installs a SIGTRAP handler, executes break 11 to trigger the underflow, then opens a socket from within the handler. The resulting socket is attributed to the root cgroup and evades cgroup-scoped BPF socket-creation policies. See the referenced kernel commits for the exact code paths.
Detection Methods for CVE-2026-89902
Indicators of Compromise
- Userspace processes issuing break 11 instructions outside of debugger or tracer workflows.
- Sockets created by non-root tasks that appear attributed to the root cgroup instead of the originating cgroup.
- Kernel warnings related to preempt count underflow (BUG: scheduling while atomic or negative preempt count messages) on LoongArch builds.
Detection Strategies
- Audit BPF cgroup socket-creation program hit counts and correlate with process cgroup membership to surface bypass patterns.
- Enable CONFIG_DEBUG_PREEMPT and CONFIG_DEBUG_ATOMIC_SLEEP on test kernels to catch preempt count anomalies during triage.
- Trace SIGTRAP delivery to non-debugged processes using eBPF or perf to identify unusual breakpoint usage.
Monitoring Recommendations
- Monitor kernel logs for preempt count underflow and scheduling-while-atomic warnings on LoongArch systems.
- Track socket creation events and validate that cgroup attribution matches the invoking task's cgroup.
- Alert on unexpected use of ptrace-adjacent primitives or SIGTRAP handlers by network-facing workloads.
How to Mitigate CVE-2026-89902
Immediate Actions Required
- Apply the upstream fix by rebasing to a kernel that includes commits 72ce4b2, 7639510, a1cb727, c4357eb, or ff40e59 on the appropriate stable branch.
- Rebuild and redeploy LoongArch kernels across affected fleets, prioritizing hosts that enforce cgroup-scoped BPF network policies.
- Review BPF cgroup socket-creation policies and ensure defense-in-depth controls do not rely solely on cgroup attribution.
Patch Information
The fix returns early from kprobe_singlestep_handler() when kprobe_running() reports no active probe, preventing the unbalanced preempt_enable_no_resched(). Patch commits are available at Kernel Git Commit 72ce4b2, Kernel Git Commit 7639510, Kernel Git Commit a1cb727, Kernel Git Commit c4357eb, and Kernel Git Commit ff40e59.
Workarounds
- Disable Kprobes on LoongArch systems where the feature is not required by unsetting CONFIG_KPROBES in the kernel build.
- Restrict local access on LoongArch hosts and enforce least-privilege execution for untrusted workloads.
- Layer network egress controls at the host or network boundary so cgroup socket-creation policies are not the sole enforcement point.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
