CVE-2026-89905 Overview
CVE-2026-89905 is a Linux kernel vulnerability affecting the LoongArch BPF just-in-time (JIT) compiler. The flaw resides in the stack layout logic where the optional arena register slot is placed above the tail call counter (TCC) context. When arena_vm_start is dynamically enabled, it shifts the relative offset of the tcc_ptr slot within the stack frame. Hardcoded tracking macros then mismatch the actual layout, potentially leading to memory misalignment or corruption during BPF program execution.
Critical Impact
Misaligned stack slots in LoongArch BPF JIT can trigger memory corruption during tail call operations, potentially compromising kernel stability or integrity.
Affected Products
- Linux kernel — LoongArch architecture BPF JIT subsystem
- Kernel builds with BPF arena feature enabled on LoongArch
- Upstream stable branches prior to the referenced fix commits
Discovery Timeline
- 2026-09-16 - CVE-2026-89905 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89905
Vulnerability Analysis
The vulnerability affects the LoongArch BPF JIT compiler's stack frame construction. The build_prologue() and epilogue routines allocate stack slots for callee-saved registers, the tail call counter pointer (tcc_ptr), and an optional arena register. The original layout placed the arena register slot above the TCC context slots.
When arena_vm_start is dynamically enabled, the arena slot allocation shifts the relative offset of tcc_ptr inside the stack frame. Tracking macros in the JIT rely on hardcoded offsets to reference the TCC context. The mismatch between the assumed offset and the actual offset causes reads and writes to land at incorrect stack locations.
This stack layout inconsistency is a memory misalignment issue [CWE-119-class] that can propagate into memory corruption during BPF tail call execution. The tail call counter is essential for enforcing BPF program recursion limits, so incorrect access to this slot has broader safety implications for the kernel BPF runtime.
Root Cause
The root cause is the ordering of stack slot allocation in the LoongArch BPF JIT prologue. Placing the conditional arena slot above the fixed TCC context slot makes the TCC offset dependent on a runtime feature flag rather than a fixed distance from the base callee-saved registers.
Attack Vector
Exploitation requires the ability to load and execute BPF programs on a LoongArch system with arena features enabled. This typically requires elevated privileges. Programs that trigger tail calls under arena-enabled configurations may cause the JIT to emit code that reads or writes to unintended stack offsets. See the Kernel Git Commit CD7E356 and Kernel Git Commit F0E4D069 for the resolved implementation.
Detection Methods for CVE-2026-89905
Indicators of Compromise
- Unexpected kernel panics or oops messages originating from BPF JIT-generated code on LoongArch hosts
- Stack corruption warnings or KASAN reports referencing BPF tail call paths
- Anomalous BPF program termination with invalid tail call counter values
Detection Strategies
- Audit kernel build configurations to identify LoongArch systems compiled with BPF arena support enabled
- Enable KASAN and BPF verifier debug logging on test systems to surface stack access anomalies
- Track kernel version and commit hash inventory against the fix commits cd7e356b and f0e4d069
Monitoring Recommendations
- Collect dmesg and kernel crash telemetry from LoongArch fleets and centralize for correlation
- Monitor BPF program load events and privileged user activity that invokes bpf() syscalls
- Alert on repeated BPF-related kernel warnings or oops signatures across similar hosts
How to Mitigate CVE-2026-89905
Immediate Actions Required
- Identify LoongArch Linux systems running kernels prior to the referenced fix commits
- Apply the upstream patches that reorder the stack layout in build_prologue() and __build_epilogue()
- Restrict bpf() syscall access to trusted workloads by enforcing CAP_BPF and CAP_SYS_ADMIN boundaries
Patch Information
The fix moves the arena register save and restore sequences below the tail call counter context slots in both build_prologue() and the epilogue. __build_epilogue() is updated to insert an offset decrement that safely skips the unneeded tcc_ptr reading block while aligning with the relocated arena slot. After the patch, the tcc_ptr slot sits at a fixed distance below the base callee-saved registers independent of arena feature state. Reference the Kernel Git Commit CD7E356 and Kernel Git Commit F0E4D069 for the resolved implementation.
Workarounds
- Disable BPF arena features on affected LoongArch kernels until the fix is applied
- Limit BPF program loading to root or trusted service accounts through Linux capability controls
- Deploy seccomp or LSM policies that restrict bpf() syscall usage for non-privileged workloads
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
