CVE-2026-89581

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf, x86: Fix per-CPU address resolution into an extended register

The destination of the per-CPU address MOV is encoded in ModRM.reg,

which is extended by REX.R, but the REX prefix is built with

add_1mod(), which sets REX.B. REX.B extends ModRM.rm and SIB.base, and

this instruction addresses memory as disp32 with no base, so the bit

has no effect at all and the high register bit is simply lost.

Every is_ereg() destination therefore resolves to the wrong register,

picking whichever one shares the low three bits:

R5 -> RAX R7 -> RBP R8 -> RSI R9 -> RDI

With BPF_REG_5, whose reg2hex is 0, the emitted

65 49 03 04 25 <off> add %gs:<off>,%rax

adds the per-CPU offset to RAX rather than R8. The destination keeps

the unadjusted address and RAX is clobbered, so the program goes on to

dereference a pointer that was never made per-CPU:

BUG: unable to handle page fault for address: 0000607e386a8894

RIP: bp

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References