Always-Incorrect Control Flow Implementation in Linux kernel - CVE-2026-23417
Published: April 3, 2026
Vulnerability identifier: #VU124855
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-23417
CWE-ID: CWE-670
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to bypass constant blinding in JIT-compiled BPF code.
The vulnerability exists due to improper handling of BPF_PROBE_MEM32 immediate stores in bpf_jit_blind_insn() when processing BPF programs for JIT compilation. A local user can supply a BPF program with user-controlled 32-bit immediates to bypass constant blinding in JIT-compiled BPF code.
The issue occurs when BPF_ST|BPF_MEM instructions are rewritten to BPF_ST|BPF_PROBE_MEM32 during verification before constant blinding runs, causing the immediate store instruction to fall through unblinded when JIT hardening is enabled.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-23417
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.85-1
linux (Debian package) - update to 6.12.85-1