In the Linux kernel, the following vulnerability has been resolved:
riscv, bpf: Sign extend struct ops return values properly
The ns_bpf_qdisc selftest triggers a kernel panic:
Unable to handle kernel paging request at virtual address ffffffffa38dbf58 Current test_progs pgtable: 4K pagesize, 57-bit VAs, pgdp=0x00000001109cc000 [ffffffffa38dbf58] pgd=000000011fffd801, p4d=000000011fffd401, pud=000000011fffd001, pmd=0000000000000000 Oops [#1] Modules linked in: bpf_testmod(OE) xt_conntrack nls_iso8859_1 [...] [last unloaded: bpf_testmod(OE)] CPU: 1 UID: 0 PID: 23584 Comm: test_progs Tainted: G W OE 6.17.0-rc1-g2465bb83e0b4 #1 NONE Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2024.01+dfsg-1ubuntu5.1 01/01/2024 epc : __qdisc_run+0x82/0x6f0 ra : __qdisc_run+0x6e/0x6f0 epc : ffffffff80bd5c7a ra : ffffffff80bd5c66 sp : ff2000000eecb550 gp : ffffffff82472098 tp : ff60000096895940 t0 : ffffffff8001f180 t1 : ffffffff801e1664 t2 : 0000000000000000 s0 : ff2000000eecb5d0 s1 : ff60000093a6a600 a0 : ffffffffa38dbee8 a1 : 0000000000000001 a2 : ff2000000eecb510 a3 : 0000000000000001 a4 : 0000000000000000 a5 : 0000000000000010 a6 : 0000000000000000 a7 : 0000000000735049 s2 : ffffffffa38dbee8 s3 : 0000000000000040 s4 : ff6000008bcda000 s5 : 0000000000000008 s6 : ff60000093a6a680 s7 : ff60000093a6a6f0 s8 : ff60000093a6a6ac s9 : ff60000093140000 s10: 0000000000000000 s11: ff2000000eecb9d0 t3 : 0000000000000000 t4 : 0000000000ff0000 t5 : 0000000000000000 t6 : ff60000093a6a8b6 status: 0000000200000120 badaddr: ffffffffa38dbf58 cause: 000000000000000d [<ffffffff80bd5c7a>] __qdisc_run+0x82/0x6f0 [<ffffffff80b6fe58>] __dev_queue_xmit+0x4c0/0x1128 [<ffffffff80b80ae0>] neigh_resolve_output+0xd0/0x170 [<ffffffff80d2daf6>] ip6_finish_output2+0x226/0x6c8 [<ffffffff80d31254>] ip6_finish_output+0x10c/0x2a0 [<ffffffff80d31446>] ip6_output+0x5e/0x178 [<ffffffff80d2e232>] ip6_xmit+0x29a/0x608 [<ffffffff80d6f4c6>] inet6_csk_xmit+0xe6/0x140 [<ffffffff80c985e4>] __tcp_transmit_skb+0x45c/0xaa8 [<ffffffff80c995fe>] tcp_connect+0x9ce/0xd10 [<ffffffff80d66524>] tcp_v6_connect+0x4ac/0x5e8 [<ffffffff80cc19b8>] __inet_stream_connect+0xd8/0x318 [<ffffffff80cc1c36>] inet_stream_connect+0x3e/0x68 [<ffffffff80b42b20>] __sys_connect_file+0x50/0x88 [<ffffffff80b42bee>] __sys_connect+0x96/0xc8 [<ffffffff80b42c40>] __riscv_sys_connect+0x20/0x30 [<ffffffff80e5bcae>] do_trap_ecall_u+0x256/0x378 [<ffffffff80e69af2>] handle_exception+0x14a/0x156 Code: 892a 0363 1205 489c 8bc1 c7e5 2d03 084a 2703 080a (2783) 0709 ---[ end trace 0000000000000000 ]---
The bpf_fifo_dequeue prog returns a skb which is a pointer. The pointer is treated as a 32bit value and sign extend to 64bit in epilogue. This behavior is right for most bpf prog types but wrong for struct ops which requires RISC-V ABI.
So let's sign extend struct ops return values according to the function model and RISC-V ABI([0]).
[0]: https://riscv.org/wp-content/uploads/2024/12/riscv-calling.pdf
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Ubuntu | — | Upgrade linux-image-6.17.0-14-generic-64kUpgrade linux-image-azure-lts-24.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-generic-6.17Upgrade linux-image-generic-64kUpgrade linux-image-ibm-classicUpgrade linux-image-lowlatency-64kUpgrade linux-image-oem-22.04bUpgrade linux-image-6.8.0-1052-gcp-64kUpgrade linux-image-virtual-6.8Upgrade linux-image-6.8.0-1035-gkeopUpgrade linux-image-6.8.0-1047-oracle-64kUpgrade linux-image-gkeopUpgrade linux-image-6.8.0-2040-raspi-realtimeUpgrade linux-image-6.8.0-1048-gke-64kUpgrade linux-image-6.17.0-1006-realtimeUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-oem-22.04Upgrade linux-image-6.17.0-1011-oemUpgrade linux-image-6.8.0-1050-awsUpgrade linux-image-gke-6.8Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-raspi-6.17Upgrade linux-image-fipsUpgrade linux-image-6.17.0-1007-aws-64kUpgrade linux-image-gcpUpgrade linux-image-virtual-6.17Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1049-ibmUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-raspi-realtimeUpgrade linux-image-6.17.0-1007-awsUpgrade linux-image-6.8.0-106-genericUpgrade linux-image-azure-fipsUpgrade linux-image-fips-6.8Upgrade linux-image-6.17.0-1007-oracleUpgrade linux-image-xilinxUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-lowlatencyUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-ibm-6.8Upgrade linux-image-nvidiaUpgrade linux-image-generic-64k-6.8Upgrade linux-image-6.8.0-1048-gkeUpgrade linux-image-6.17.0-1008-azureUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-raspiUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-gcp-fipsUpgrade linux-image-genericUpgrade linux-image-gkeop-6.8Upgrade linux-image-azure-fips-6.8Upgrade linux-image-azure-6.17Upgrade linux-image-aws-64k-6.8Upgrade linux-image-generic-6.8Upgrade linux-image-6.8.0-1052-azure-fipsUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-realtime-hwe-22.04Upgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-ibmUpgrade linux-image-oem-22.04cUpgrade linux-image-azureUpgrade linux-image-6.17.0-1007-gcpUpgrade linux-image-aws-6.8Upgrade linux-image-oem-22.04aUpgrade linux-image-6.8.1-1045-realtimeUpgrade linux-image-gke-64kUpgrade linux-image-aws-6.17Upgrade linux-image-6.8.0-106-fipsUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-6.17.0-14-genericUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.8.0-1047-oracleUpgrade linux-image-lowlatency-6.8Upgrade linux-image-intel-iotgUpgrade linux-image-oracle-6.17Upgrade linux-image-kvmUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-gkeUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-generic-64k-6.17Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-gcp-64k-6.17Upgrade linux-image-aws-64kUpgrade linux-image-virtualUpgrade linux-image-oracle-64k-6.17Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-aws-fipsUpgrade linux-image-nvidia-6.8Upgrade linux-image-gcp-64kUpgrade linux-image-aws-lts-24.04Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-6.8.0-106-lowlatencyUpgrade linux-image-6.8.0-1049-nvidiaUpgrade linux-image-6.8.0-106-lowlatency-64kUpgrade linux-image-6.8.0-1052-gcp-fipsUpgrade linux-image-6.8.0-1050-aws-fipsUpgrade linux-image-6.8.0-1049-nvidia-64kUpgrade linux-image-6.8.0-1029-xilinxUpgrade linux-image-gcp-6.17Upgrade linux-image-gke-64k-6.8Upgrade linux-image-raspi-6.8Upgrade linux-image-6.17.0-1008-raspiUpgrade linux-image-6.17.0-1007-oracle-64kUpgrade linux-image-xilinx-6.8Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-aws-64k-6.17Upgrade linux-image-6.8.0-1049-nvidia-lowlatencyUpgrade linux-image-6.8.0-106-generic-64kUpgrade linux-image-awsUpgrade linux-image-oracleUpgrade linux-image-realtimeUpgrade linux-image-realtime-6.17Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-realtime-6.8.1Upgrade linux-image-oracle-6.8Upgrade linux-image-oem-6.17Upgrade linux-image-oem-22.04dUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-gcp-6.8Upgrade linux-image-aws-fips-6.8Upgrade linux-image-6.8.0-1050-aws-64kUpgrade linux-image-6.17.0-1007-gcp-64kUpgrade linux-image-6.8.0-1052-gcpUpgrade linux-image-nvidia-64kUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.8.0-1050-raspiUpgrade linux-image-6.8.0-1049-nvidia-lowlatency-64kUpgrade linux-image-azure-6.8 | Feb 13, 2026 | Feb 12, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub