SB2026102659 - Always-Incorrect Control Flow Implementation in Linux kernel riscv kernel

Description

This security bulletin contains information about 1 vulnerability.

1) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-99092)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause BPF just-in-time compilation to fail on affected RISC-V systems.

The vulnerability exists due to incorrect configuration-dependent control flow in the RISC-V patch_map() function when copying BPF instructions into read-only executable memory with CONFIG_STRICT_MODULE_RWX disabled. A local user can trigger BPF just-in-time compilation to cause instruction copying to fail because a temporary writable mapping is not created, leaving the BPF program un-JITed.

Builds without MMU support are unaffected.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/562a35b9e0b3d9483d9472995219cadb3592db3d
• https://git.kernel.org/stable/c/9e8fc7972b398e9dc2415ece283d8f64edac3858
• https://git.kernel.org/stable/c/a510e1ae8c9030750c2edf7b0bc9b186cd8c7a06
• https://git.kernel.org/stable/c/f71d6ea3843c8038c431c2699482f246aea37ca0