Always-Incorrect Control Flow Implementation in Linux kernel - CVE-2026-99092

Vulnerability details

The vulnerability allows a local user to cause BPF just-in-time compilation to fail on affected RISC-V systems.

The vulnerability exists due to incorrect configuration-dependent control flow in the RISC-V patch_map() function when copying BPF instructions into read-only executable memory with CONFIG_STRICT_MODULE_RWX disabled. A local user can trigger BPF just-in-time compilation to cause instruction copying to fail because a temporary writable mapping is not created, leaving the BPF program un-JITed.

Builds without MMU support are unaffected.

Affected software

How to mitigate CVE-2026-99092

External References

• https://git.kernel.org/stable/c/562a35b9e0b3d9483d9472995219cadb3592db3d
• https://git.kernel.org/stable/c/9e8fc7972b398e9dc2415ece283d8f64edac3858
• https://git.kernel.org/stable/c/a510e1ae8c9030750c2edf7b0bc9b186cd8c7a06
• https://git.kernel.org/stable/c/f71d6ea3843c8038c431c2699482f246aea37ca0

Related Security Bulletins

• Always-Incorrect Control Flow Implementation in Linux kernel riscv kernel
• Debian update for linux