CVE-2026-89906: LoongArch: BPF: Refactor jump offset calculation in tail call

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-16 · updated 2026-10-21

Description

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Refactor jump offset calculation in tail call The old macro-based jmp_offset calculation derives the jump distance from a stale prior-pass code stride, which can lead to wrong branch offsets and soft lockups under extra JIT passes. Fix this by calculating the offset directly on the absolute target: "ctx->offset[insn + 1] - ctx->idx". To avoid a false 16-bit range check abort during size estimation, add a "ctx->image == NULL" guard to inject a safe dummy offset.

Affected products

Linux kernel: from 6.6.103 before 6.6.160; from 6.12.43 before 6.12.114; from 6.1.149 before 6.2; from 6.15.11 before 6.16; from 6.16.2 before 6.17; 6.17 — fixed in 6.12.114, 6.16, 6.17, 6.2, 6.6.160, 7.3

How to fix

Upgrade to a fixed version: Linux kernel 6.12.114, 6.16, 6.17, 6.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-89906 or the next vulnerability affects your stack