CVE-2026-89905

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: BPF: Move arena register slot below TCC context

Currently, the stack layout places the optional arena register slot

above the tail call counter context. When arena_vm_start is dynamically

enabled, it shifts the relative offset of the tcc_ptr slot within the

stack frame, causing hardcoded tracking macros to mismatch and leading

to memory misalignment or corruption potentially.

To fix this, move the arena register save and restore sequences below

the tail call counter context slots in both build_prologue() and the

epilogue.

Update __build_epilogue() to insert a proper offset decrement to safely

skip the unneeded tcc_ptr reading block while accurately aligning with

the relocated arena slot at the very bottom.

With this patch, the tcc_ptr slot is always positioned at a fixed

distance directly underneath the base callee-saved registers that is

independent of whether the arena features are on.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References