SB2026040306 - Always-Incorrect Control Flow Implementation in Linux kernel bpf

Description

This security bulletin contains information about 1 security vulnerability.

1) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-23417)

The vulnerability allows a local user to bypass constant blinding in JIT-compiled BPF code.

The vulnerability exists due to improper handling of BPF_PROBE_MEM32 immediate stores in bpf_jit_blind_insn() when processing BPF programs for JIT compilation. A local user can supply a BPF program with user-controlled 32-bit immediates to bypass constant blinding in JIT-compiled BPF code.

The issue occurs when BPF_ST|BPF_MEM instructions are rewritten to BPF_ST|BPF_PROBE_MEM32 during verification before constant blinding runs, causing the immediate store instruction to fall through unblinded when JIT hardening is enabled.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2321a9596d2260310267622e0ad8fbfa6f95378f
• https://git.kernel.org/stable/c/56af722756ed82fee2ae5d5b4d04743407506195
• https://git.kernel.org/stable/c/ccbf29b28b5554f9d65b2fb53b994673ad58b3bf
• https://git.kernel.org/stable/c/de641ea08f8fff6906e169d2576c2ac54e562fbb