SB20260928268 - Incorrect calculation in Linux kernel x86 kernel

Description

This security bulletin contains information about 1 vulnerability.

1) Incorrect calculation (CVE-ID: CVE-2026-97944)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an incorrect hash offset calculation in cfi_get_func_hash() when the BPF JIT obtains the CFI hash for a struct_ops trampoline. A local privileged user can cause the kernel to make an indirect call into a BPF struct_ops program to cause a denial of service.

Only systems built with CONFIG_FINEIBT are affected.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/5a5d26f2cfe13467166219f6bf58099326912ddb
• https://git.kernel.org/stable/c/67cf94c30a8b5ebc839f282f5c5a522b35903524
• https://git.kernel.org/stable/c/cd9b4595d6283f9b8a35d7ae607508de45a351ce