{"id":"CVE-2026-99092","kind":"vulnerability","aliases":["CVE-2026-99092"],"related":[],"title":"Linux kernel RISC-V: BPF JIT patching fails when strict module RWX is off","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: patch: fix handling of bpf-jit execmem addresses\n\nCommit 8718e5a3090b (\"riscv: patch: skip fixmap mapping when kernel text\nis already writable\") gated the core_kernel_text() branch of patch_map()\non CONFIG_STRICT_KERNEL_RWX, and explicitly left the vmalloc branch\nunchanged. That branch has a separate problem.\n\nThat branch only creates a temporary writable fixmap alias when\nCONFIG_STRICT_MODULE_RWX is enabled, and otherwise assumes the target is\ndirectly writable and returns the address unchanged. That assumption no\nlonger holds: bpf_prog_pack_alloc calls set_memory_rox() on every pack\nunconditionally in alloc_new_pack(), independently of any\nCONFIG_STRICT_*_RWX option, so BPF text in the vmalloc area is read-only\nregardless of what CONFIG_STRICT_MODULE_RWX says.\n\nWith CONFIG_STRICT_MODULE_RWX=n, patch_map() returns the read-only\naddress directly, the subsequent copy_to_kernel_nofault() takes a\npage fault and returns -EFAULT. bpf_arch_text_copy() turns that into\n-EINVAL, which propagates through bpf_jit_binary_pack_finalize() to the\nWARN_ON() in bpf_int_jit_compile() and leaves the program un-JITed.\n\nNote that BPF cannot be fixed the way kprobes was in\ncommit bdc46e507b59 (\"riscv: mm: make EXECMEM_KPROBES writable without\nCONFIG_STRICT_MODULE_RWX\"). EXECMEM_BPF is already PAGE_KERNEL, i.e.\nwritable at allocation time; the read-only mapping is established\nafterwards by generic code in alloc_new_pack(), which arch code cannot\ninfluence. The only place this can be handled is patch_map().\n\nThis is the same problem that was fixed on arm64 by commit b1480ed230ac\n(\"arm64: patching: fix handling of execmem addresses\"), and the fix is\nthe same: CONFIG_EXECMEM is what actually tracks whether the vmalloc\narea can hold executable memory that needs a temporary alias to be\nwritten. CONFIG_BPF_JIT, CONFIG_KPROBES and CONFIG_MODULES all select\nit.\n\nNote that this is not limited to CONFIG_MODULES=n. Unlike arm64, riscv\nselects CONFIG_ARCH_OPTIONAL_KERNEL_RWX, so CONFIG_STRICT_MODULE_RWX can\nbe disabled with CONFIG_MODULES=y as well, and the bug is reachable in\nthat configuration too.\n\nThe !CONFIG_MMU build is unaffected: it has its own __patch_insn_set()\nand __patch_insn_write() implementations and never calls patch_map().","summary":"On RISC-V kernels built without CONFIG_STRICT_MODULE_RWX, writing BPF JIT code to read-only vmalloc memory faults, so the BPF program is left un-JITed. The sources describe a robustness failure rather than an attacker gaining code execution or data.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bpf","linux-kernel","riscv","runtime"],"not_affected_if":["bpf-jit-disabled","non-riscv-architecture","strict-module-rwx-enabled"],"how_to_check":"- Check whether the running kernel config sets `CONFIG_STRICT_MODULE_RWX` to `n`, for example with `grep STRICT_MODULE_RWX /boot/config-$(uname -r)`\n- Confirm the kernel is RISC-V with `uname -m` returning `riscv64`\n- Check whether `CONFIG_BPF_JIT` is enabled in the same config file","fix":"- Update the Linux kernel to a release that includes the upstream commit fixing patch_map() for bpf-jit execmem addresses, referenced as commit 8718e5a3090b follow-up in the NVD entry\n- Rebuild or update the kernel package from your distribution vendor once it ships the fix; exact fixed versions are unknown from the sources","status":"open","published_at":"2026-10-26T15:16:48+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","triaged_at":"2026-10-26T16:04:09+00:00","updated_at":"2026-10-26T16:04:09+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-26T16:04:09Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit fixing patch_map() for bpf-jit execmem addresses, referenced as commit 8718e5a3090b follow-up in the NVD entry\n- Rebuild or update the kernel package from your distribution vendor once it ships the fix; exact fixed versions are unknown from the sources","reach":"local","title":"Linux kernel RISC-V: BPF JIT patching fails when strict module RWX is off","impact":"low","summary":"On RISC-V kernels built without CONFIG_STRICT_MODULE_RWX, writing BPF JIT code to read-only vmalloc memory faults, so the BPF program is left un-JITed. The sources describe a robustness failure rather than an attacker gaining code execution or data.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","riscv","bpf"],"confidence":0.6,"needs_auth":"unknown","worst_case":"BPF programs fail to JIT, causing kernel warnings and slower execution","analyst_note":"Confirm the fixed kernel version and the upstream commit ID from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-99092 and distribution advisories.","how_to_check":"- Check whether the running kernel config sets `CONFIG_STRICT_MODULE_RWX` to `n`, for example with `grep STRICT_MODULE_RWX /boot/config-$(uname -r)`\n- Confirm the kernel is RISC-V with `uname -m` returning `riscv64`\n- Check whether `CONFIG_BPF_JIT` is enabled in the same config file","needs_analyst":true,"not_affected_if":["non-riscv-architecture","strict-module-rwx-enabled","bpf-jit-disabled"],"who_is_affected":"RISC-V Linux systems where BPF JIT is used and CONFIG_STRICT_MODULE_RWX is disabled, including the CONFIG_MODULES=y case where that option is off. Systems on x86, arm64, or other architectures are not described as affected. Kernels with strict module RWX enabled are not described as affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000816,"input_tokens":4226,"output_tokens":786,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-99092':16A,19A '8718e5':93C 'a3090b':94C 'actual':364C 'address':91C,160C,222C,353C 'afterward':311C 'alia':141C,378C 'alloc':170C,180C,302C,316C 'alreadi':104C,296C 'arch':238C,320C,408C 'area':196C,369C 'arm64':343C,347C,404C 'assum':151C 'assumpt':163C 'attack':66B 'b1480ed230ac':346C 'bdc46e507b59':281C 'binari':250C 'bpf':6A,20B,38B,50B,88C,167C,191C,237C,248C,258C,271C,294C,383C 'bpf-jit':87C 'branch':111C,125C,128C,134C 'bug':428C 'build':438C 'built':31B 'call':171C,455C 'cannot':272C,322C 'code':40B,68B,314C,321C 'commit':92C,280C,345C 'compil':261C 'config':33B,116C,143C,186C,204C,210C,289C,360C,382C,385C,388C,400C,407C,413C,421C,436C 'configur':433C 'copi':226C,240C 'core':108C 'creat':136C 'cve':14A,17A 'data':71B 'describ':59B 'direct':155C,223C 'disabl':419C 'efault':236C 'einval':244C 'enabl':148C 'establish':310C 'everi':176C 'execmem':90C,285C,293C,352C,361C 'execut':69B,372C 'explicit':121C 'fail':9A 'failur':62B 'fault':47B,233C 'final':252C 'fix':84C,274C,341C,349C,356C 'fixmap':98C,140C 'follow':77C 'gain':67B 'gate':106C 'generic':313C 'handl':85C,330C,350C 'hold':166C,371C 'i.e':299C 'implement':452C 'independ':183C 'influenc':323C 'insn':446C,450C 'int':259C 'jit':7A,39B,89C,249C,260C,384C 'jite':56B,268C 'kernel':2A,23B,30B,75C,101C,109C,118C,228C,298C,410C 'kprobe':277C,286C,386C 'leav':263C 'left':53B,122C 'limit':398C 'linux':1A,22B,74C 'linux-kernel':21B 'longer':165C 'make':284C 'map':99C,114C,216C,308C,333C,457C 'memori':46B,173C,373C 'mm':283C 'mmu':437C 'modul':12A,35B,145C,206C,212C,291C,389C,401C,415C,422C 'n':214C,402C 'need':375C 'never':454C 'new':181C,317C 'nofault':229C 'note':269C,393C 'option':189C,409C 'otherwis':150C 'pack':169C,177C,182C,251C,318C 'page':232C,297C 'patch':8A,83C,96C,113C,215C,332C,348C,445C,449C,456C 'place':326C 'problem':132C,338C 'prog':168C 'program':51B,265C 'propag':246C 'rather':63B 'reachabl':430C 'read':43B,199C,220C,306C 'read-on':42B,198C,219C,305C 'regardless':201C 'resolv':81C 'return':158C,217C,235C 'risc':4A,28B 'risc-v':3A,27B 'riscv':24B,82C,95C,282C,405C 'robust':61B 'rox':174C 'runtim':25B 'rwx':13A,36B,119C,146C,188C,207C,213C,292C,411C,416C 'say':208C 'select':391C,406C 'separ':131C 'set':172C,447C 'skip':97C 'sourc':58B 'strict':11A,34B,117C,144C,187C,205C,211C,290C,414C 'subsequ':225C 'take':230C 'target':153C 'temporari':138C,377C 'text':102C,110C,192C,239C 'time':303C 'track':365C 'turn':241C 'un':55B,267C 'un-jit':54B,266C 'unaffect':440C 'unchang':126C,161C 'uncondit':178C 'unlik':403C 'v':5A,29B 'vmalloc':45B,124C,195C,368C 'vulner':78C 'warn':255C 'way':276C 'well':425C 'whether':366C 'without':32B,288C 'writabl':105C,139C,156C,287C,300C 'write':37B,451C 'written':381C 'y':423C","nicknames":[],"mitigations":[],"who_affected":"RISC-V Linux systems where BPF JIT is used and CONFIG_STRICT_MODULE_RWX is disabled, including the CONFIG_MODULES=y case where that option is off. Systems on x86, arm64, or other architectures are not described as affected. Kernels with strict module RWX enabled are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T15:16:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99092","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99092","severity":null,"published_at":"2026-10-26T15:16:48+00:00","modified_at":"2026-10-26T15:16:48+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","fetched_at":"2026-10-26T16:02:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}