From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CD22C4D90D6 for ; Wed, 16 Sep 2026 10:38:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789555118; cv=none; b=tCvBTLnaRPltVDpf/nbtEAjQYPxSOINNTc+TXAwI6ya8JwAvOFyoLll6TP5AmQowRBxX7b56osNQr7W/HHXZf6IUmjRbrTEOwOgSCMubtCC+HIsZoMC6lCNIM2e+5XPsk0TevGMJVIZ7EiGIKZrjA3uO7rg22yI4I9yaLO3jxug= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789555118; c=relaxed/simple; bh=C1u3C5jyA9EbbMAcUvJS2v6DVHsq6d1c9Pl2XkGAUVQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=X5NBWce9NF2OuALGu43TbIsG2/F/UDgFUOCoNTgZVoOFdQMRYA30oQ7G1M8JanLbdR7UK/8dotcO+H4pFksu57jhRKYuKifPsxNdz+R+ax11WjCqIh6aUS0mO/XI4M22utBoLTM0nQ6q5DxD+xjGCMQaiDeaW8ik8kxBxpWmJBc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=cXJ5Koc9; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="cXJ5Koc9" Received: by smtp.kernel.org (Postfix) with ESMTPSA id BAA321F0089A; Wed, 16 Sep 2026 10:38:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789555102; bh=oQ/Q3RlhLiBZxOG5suDX1+Q0vgUZKgX1AObLCYCT2+k=; h=From:To:Cc:Subject:Date:Reply-To; b=cXJ5Koc9sHk14LpKLhQqyVghcPLs44C/7fT13bDTSNM3kJjrInI7noF2wZ3gfQxG6 YAF+C0wiwrTbHqaDBqZBW2Mwt7Jdpw1slJXMlw5+ogLIXEaHNtJ6wqaGQJFx3ZysVk WhNeP7985AzjJpulGKMZrKyg0CT3vNaq/SQSVAEg= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-89906: LoongArch: BPF: Refactor jump offset calculation in tail call Date: Wed, 16 Sep 2026 11:30:36 +0100 Message-ID: <2026091640-CVE-2026-89906-17db@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2847; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=BdBhggPRJOjZipGL+2DFZRs0LlFp4eGPJLiRhd2LexI=; b=owGbwMvMwCRo6H6F97bub03G02pJDFmr8qeoLSgJnHRac1KdyN4mUZb7Emff514773BeoGbbt z088/Vmd8SyMAgyMciKKbJ82cZzdH/FIUUvQ9vTMHNYmUCGMHBxCsBEDhcwzDOtO87133xj1gKF pXFrbjlYPPM1sGaYK/fayeFFwKwVS/rmix9dVekuVubzEwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Refactor jump offset calculation in tail call The old macro-based jmp_offset calculation derives the jump distance from a stale prior-pass code stride, which can lead to wrong branch offsets and soft lockups under extra JIT passes. Fix this by calculating the offset directly on the absolute target: "ctx->offset[insn + 1] - ctx->idx". To avoid a false 16-bit range check abort during size estimation, add a "ctx->image == NULL" guard to inject a safe dummy offset. The Linux kernel CVE team has assigned CVE-2026-89906 to this issue. Affected and fixed versions =========================== Issue introduced in 6.17 with commit cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3 and fixed in 6.18.51 with commit 882b8912b7e92341fdb115ba0e2e5142a28684ff Issue introduced in 6.17 with commit cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3 and fixed in 7.2.5 with commit 96f44d493c280ea161569c43d7ed0f3b0815803a Issue introduced in 6.17 with commit cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3 and fixed in 7.3-rc1 with commit 37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8 Issue introduced in 6.1.149 with commit 1a782fa32e644aa9fbae6c8488f3e61221ac96e1 Issue introduced in 6.6.103 with commit 17c010fe45def335fe03a0718935416b04c7f349 Issue introduced in 6.12.43 with commit f83d469e16bb1f75991ca67c56786fb2aaa42bea Issue introduced in 6.15.11 with commit f2b5e50cc04d7a049b385bc1c93b9cbf5f10c94f Issue introduced in 6.16.2 with commit 9262e3e04621558e875eb5afb5e726b648cd5949 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-89906 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: arch/loongarch/net/bpf_jit.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/882b8912b7e92341fdb115ba0e2e5142a28684ff https://git.kernel.org/stable/c/96f44d493c280ea161569c43d7ed0f3b0815803a https://git.kernel.org/stable/c/37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8