CVE-2026-89905: LoongArch: BPF: Move arena register slot below TCC context

CVE-2026-89905: LoongArch: BPF: Move arena register slot below TCC context

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: BPF: Move arena register slot below TCC context

Currently, the stack layout places the optional arena register slot
above the tail call counter context. When arena_vm_start is dynamically
enabled, it shifts the relative offset of the tcc_ptr slot within the
stack frame, causing hardcoded tracking macros to mismatch and leading
to memory misalignment or corruption potentially.

To fix this, move the arena register save and restore sequences below
the tail call counter context slots in both build_prologue() and the
epilogue.

Update __build_epilogue() to insert a proper offset decrement to safely
skip the unneeded tcc_ptr reading block while accurately aligning with
the relocated arena slot at the very bottom.

With this patch, the tcc_ptr slot is always positioned at a fixed
distance directly underneath the base callee-saved registers that is
independent of whether the arena features are on.

The Linux kernel CVE team has assigned CVE-2026-89905 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 7.0 with commit ef54c517a9376b188da06b5e1ed556129c4280be and fixed in 7.2.5 with commit f0e4d069cb47cf4f8dc4f6bc104e0671155aa3b9
	Issue introduced in 7.0 with commit ef54c517a9376b188da06b5e1ed556129c4280be and fixed in 7.3-rc1 with commit cd7e356b07a27e91394838cf3fb655862b519294

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-89905
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	arch/loongarch/net/bpf_jit.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/f0e4d069cb47cf4f8dc4f6bc104e0671155aa3b9
	https://git.kernel.org/stable/c/cd7e356b07a27e91394838cf3fb655862b519294