CVE-2026-89903: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89903 Overview

CVE-2026-89903 is a Linux kernel vulnerability affecting the LoongArch architecture. The flaw resides in the rethook trampoline, which improperly saves and restores the $r21 ($u0) percpu base register across a preemption point. When a task migrates to a different CPU during rethook_trampoline_handler(), the stale percpu base is restored, causing this_cpu_*() accessors to reference the wrong CPU's percpu area until the next user-to-kernel transition heals the register.

Critical Impact
Corrupted scheduler and timer state on Loongson-3A6000 systems under kretprobe-heavy preemptible load, producing scheduling-while-atomic warnings, wrong-CPU RCU splats, and CPUs parking in the idle loop with the timer tick never re-armed (hard lockup).

Affected Products

Linux kernel on LoongArch architecture
Kernel versions since v6.3 (the same flaw existed in the pre-rethook kretprobe trampoline)
Loongson-3A6000 platforms observed reproducing the issue

Discovery Timeline

2026-09-16 - CVE-2026-89903 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89903

Vulnerability Analysis

The LoongArch rethook trampoline saves the percpu base register $r21 into its stack frame on entry and restores it on exit. Between those two operations, rethook_trampoline_handler() may call preempt_enable_notrace() and schedule. If the scheduler migrates the task to another CPU, the saved value in the frame now references the previous CPU's percpu base.

When the trampoline restores $r21 from the frame, it overwrites the new CPU's correct percpu base with the stale value. Every subsequent this_cpu_*() access, including runqueue selection, RCU per-CPU state, timer tick programming, and FPU ownership tracking, targets the wrong CPU's percpu area. This is a kernel-level state corruption issue [CWE-662-class concurrency flaw].

Root Cause

By LoongArch kernel convention, $r21 always holds the current CPU's percpu base while in kernel mode. SAVE_SOME() reloads it only on user-to-kernel entry, RESTORE_SOME() restores it only on kernel-to-user exit, and the context-switch path never writes it. Kernel C code cannot legitimately modify a global register variable. The trampoline's save and restore of $r21 was therefore always redundant, and became actively harmful once preemption could migrate the task mid-handler.

Attack Vector

Exploitation requires local access with the ability to attach kretprobes and generate sustained kernel activity on preemptible kernels. The reporter reproduced the corruption on a Loongson-3A6000 using kretprobes on VFS paths combined with heavy filesystem churn such as an OS install or unsquashfs. The result is denial of service through scheduler corruption, RCU warnings, WARN_ON_ONCE(rq != this_rq()) in nohz_balance_exit_idle(), and hard lockups when CPUs park in idle with no timer re-arm.

No public proof-of-concept exploit code is available for CVE-2026-89903. Refer to the upstream fix commits for the precise change removing the save and restore of $r21.

Detection Methods for CVE-2026-89903

Indicators of Compromise

Kernel log entries containing scheduling while atomic on LoongArch systems using kretprobes.
WARN_ON_ONCE(rq != this_rq()) warnings originating from nohz_balance_exit_idle().
Wrong-CPU RCU warnings and per-CPU data inconsistencies on Loongson-3A6000 hardware.
Hard lockup reports where CPUs remain parked in the idle loop with no timer tick re-arm.

Detection Strategies

Audit LoongArch kernel builds for versions prior to the fix commits 266ffc9, 8f15e9, a03b5e7, c048b0a, and c3f2fea.
Identify hosts loading kretprobe-based tooling (bpftrace, SystemTap, kernel tracing modules) on LoongArch platforms.
Correlate kernel panic and soft/hard lockup telemetry with kretprobe attachment events.

Monitoring Recommendations

Forward kernel ring buffer (dmesg, journald) to a centralized log store and alert on scheduler and RCU warning strings.
Track loaded kernel modules and eBPF programs that install kretprobes on VFS entry points.
Monitor unexpected reboots and lockup events on LoongArch fleets alongside filesystem-intensive workloads.

How to Mitigate CVE-2026-89903

Immediate Actions Required

Inventory LoongArch hosts and identify kernels that predate the fix commits listed in the upstream references.
Restrict privileged access required to load kretprobes and eBPF tracing programs to a minimal set of administrators.
Suspend kretprobe-based tracing on VFS paths in production LoongArch systems until patched kernels are deployed.

Patch Information

Apply the upstream Linux kernel fixes that drop the save and restore of $r21 in the LoongArch rethook trampoline. Relevant commits: Kernel Patch Commit 266ffc9, Kernel Patch Commit 8f15e95, Kernel Patch Commit a03b5e7, Kernel Patch Commit c048b0a, and Kernel Patch Commit c3f2fea. Rebuild and redeploy affected kernel images across the LoongArch fleet.

Workarounds

Disable kretprobes and kretprobe-based tracing frameworks on LoongArch hosts until patched kernels are in place.
Build LoongArch kernels with CONFIG_PREEMPT disabled where operationally acceptable to reduce migration exposure in the trampoline window.
Limit filesystem-intensive workloads (OS install, unsquashfs) on unpatched Loongson-3A6000 systems where kretprobes are active.

bash

# Verify running kernel version on LoongArch hosts
uname -srm

# List active kprobes/kretprobes
cat /sys/kernel/debug/kprobes/list

# Temporarily disable kprobe events (requires root)
echo 0 > /sys/kernel/debug/tracing/events/kprobes/enable