What’s Vulnerable › Vulnerabilities

CVE-2026-93147: s390/bpf: Replace ly instruction with llgf

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-17 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Replace ly instruction with llgf cpu_nr is a 32 bit value and BPF_REG_0 is a 64 bit register, when ly loads the cpu_nr into BPF_REG_0 it does not zero the upper bits, but llgf does.

Affected products

• Linux kernel: 7.2 — fixed in 7.3

How to fix

Upgrade to a fixed version: Linux kernel 7.3. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/5f6cc299938b561cb01e343bab7042611fcee12a
• https://git.kernel.org/stable/c/88500a86ab79f01c568de6ed00f5b1c5c79f11d5

Get alerted when CVE-2026-93147 or the next vulnerability affects your stack