CVE-2026-93164

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

uprobes/x86: Move optimized uprobe from nop5 to nop10

Andrii reported an issue with optimized uprobes [1] that can clobber

redzone area with call instruction storing return address on stack

where user code may keep temporary data without adjusting rsp.

Fixing this by moving the optimized uprobes on top of 10-bytes nop

instruction, so we can squeeze another instruction to escape the

redzone area before doing the call, like:

lea -0x80(%rsp), %rsp

call tramp

Note the lea instruction is used to adjust the rsp register without

changing the flags.

We use nop10 and following transformation to optimized instructions

above and back as suggested by Peterz [2].

Optimize path (int3_update_optimize):

1) Initial state after set_swbp() installed the uprobe:

cc 2e 0f 1f 84 00 00 00 00 00

From offset 0 this is INT3 followed by the tail of the original

10-byte NOP.

After a previous unoptimization byt

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References