CVE-2026-23417

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix constant blinding for PROBE_MEM32 stores

BPF_ST | BPF_PROBE_MEM32 immediate stores are not handled by

bpf_jit_blind_insn(), allowing user-controlled 32-bit immediates to

survive unblinded into JIT-compiled native code when bpf_jit_harden >= 1.

The root cause is that convert_ctx_accesses() rewrites BPF_ST|BPF_MEM

to BPF_ST|BPF_PROBE_MEM32 for arena pointer stores during verification,

before bpf_jit_blind_constants() runs during JIT compilation. The

blinding switch only matches BPF_ST|BPF_MEM (mode 0x60), not

BPF_ST|BPF_PROBE_MEM32 (mode 0xa0). The instruction falls through

unblinded.

Add BPF_ST|BPF_PROBE_MEM32 cases to bpf_jit_blind_insn() alongside the

existing BPF_ST|BPF_MEM cases. The blinding transformation is identical:

load the blinded immediate into BPF_REG_AX via mov+xor, then convert

the immediate store to a register store (BPF_STX).

The rewritten STX instruction must preserve the BPF_PROBE_MEM32

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References