From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 381534EBADA for ; Wed, 16 Sep 2026 10:38:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789555115; cv=none; b=pRb7jKSeemWT7Ek5kN5YV699oUBUhBUFIfglpDTMMu1Sr3JdDTU4l4V/lUoROVVwGv3I7PU0OX1BlEBnz74S60irCNS9wzy7Xoc8uc8JQtpRVS7CyJr+BpJzW9VOBLal0sCVxhadOvPv06wHVeXCCXLNRQaL5ldUKW4rv/03zCg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789555115; c=relaxed/simple; bh=EJjxTpY1k35ooeIk+I6B1EkDLSVpfYfa2y4OcMJQn/A=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=jWtyoIwDN9JFqEVu/7UKCAB+E9Ldws7AMXgR7d3aU5a67afQDxlPAvLd6tdJCpgwtYrUTA1NxueVh50Fe7qH2YQZIT8E7Ja2dTw7i2sZDv+T0/il9hhjcDUThg+FzjuJqxnhN7v6pr8Y15VDqzXEsGl1kpmpckV4Muc8GIJaMvY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=0Uo5bEra; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="0Uo5bEra" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A8C101F00898; Wed, 16 Sep 2026 10:38:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789555099; bh=mQGxmhbbHn0EnFdQYVrZEVO1kR/AxlBAxYHxPMxftbU=; h=From:To:Cc:Subject:Date:Reply-To; b=0Uo5bEraN7qJPPAEq9SIIe8Gm/82UJHAa5g3JeoP4GGhGDQOjBwKRiGW6Mx8djAfp hnp8Ojoe+ZdL9qXYXuR3v1y/2MqjuoWCrM3rw/sUaIZT1DafpLfP6HEH2g3QijG3lt bEE3USWVkQ9ZV3VkdvlA+bSgm4tTMgl1p/HPe0uE= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-89905: LoongArch: BPF: Move arena register slot below TCC context Date: Wed, 16 Sep 2026 11:30:35 +0100 Message-ID: <2026091639-CVE-2026-89905-efb3@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2641; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=V1XxP+nlu5/T7zMhntnzIBnQ06bNn6BXgYuHhUwfSds=; b=owGbwMvMwCRo6H6F97bub03G02pJDFmr8qeU+2bNSTN0Pq+ccSPq/YF7cRpHtPa6dAkbFAcXf 9htVfamI5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACayaC3DgsPu/4UWaj/3dN0T diTb9OSNVMd9OgwLtp47krJ1ncR1j6wt/9Y+ZfDn41L8BgA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Move arena register slot below TCC context Currently, the stack layout places the optional arena register slot above the tail call counter context. When arena_vm_start is dynamically enabled, it shifts the relative offset of the tcc_ptr slot within the stack frame, causing hardcoded tracking macros to mismatch and leading to memory misalignment or corruption potentially. To fix this, move the arena register save and restore sequences below the tail call counter context slots in both build_prologue() and the epilogue. Update __build_epilogue() to insert a proper offset decrement to safely skip the unneeded tcc_ptr reading block while accurately aligning with the relocated arena slot at the very bottom. With this patch, the tcc_ptr slot is always positioned at a fixed distance directly underneath the base callee-saved registers that is independent of whether the arena features are on. The Linux kernel CVE team has assigned CVE-2026-89905 to this issue. Affected and fixed versions =========================== Issue introduced in 7.0 with commit ef54c517a9376b188da06b5e1ed556129c4280be and fixed in 7.2.5 with commit f0e4d069cb47cf4f8dc4f6bc104e0671155aa3b9 Issue introduced in 7.0 with commit ef54c517a9376b188da06b5e1ed556129c4280be and fixed in 7.3-rc1 with commit cd7e356b07a27e91394838cf3fb655862b519294 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-89905 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: arch/loongarch/net/bpf_jit.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/f0e4d069cb47cf4f8dc4f6bc104e0671155aa3b9 https://git.kernel.org/stable/c/cd7e356b07a27e91394838cf3fb655862b519294