CVE-2026-23383

Vulnerability

The BPF JIT allocator for arm64 in the Linux kernel requests only 4-byte alignment for the JIT buffer, while the struct bpf_plt contains a u64 target field that requires 8-byte alignment for atomic operations. Because the base address can be 4-byte aligned (e.g., ending in 0x4 or 0xc), the padding logic in build_plt() fails to guarantee that the target field lands on an 8-byte boundary. This results in two issues: UBSAN reports misaligned-access warnings, and more critically, the target field is updated concurrently via WRITE_ONCE() in bpf_arch_text_poke() while JIT'd code executes an attacker can trigger a torn read of the 64-bit value, causing the JIT to jump to a corrupted address [1][2].

Exploitation

An attacker with the ability to load and execute BPF programs (typically requiring CAP_BPF or root privileges) can exploit this vulnerability. The attack surface is local, as BPF programs are loaded from userspace. No special network access is needed. The prerequisite is that the system runs an arm64 kernel with the BPF JIT enabled. The attacker crafts a BPF program that triggers the misaligned access, leading to a torn read of the target pointer during a concurrent update [3].

Impact

A successful exploit could allow an attacker to redirect execution to an arbitrary address, potentially leading to arbitrary code execution in kernel context. This could result in full system compromise, including privilege escalation and bypass of security mechanisms. The CVSS v3 score of 7.8 (High)8 (High) reflects the high impact on confidentiality, integrity and availability, though the attack complexity is high due to the need for precise timing [4].

Mitigation

The fix increases the allocation alignment requirement to 8 bytes (sizeof(u64)) in bpf_jit_binary_pack_alloc(), ensuring the base of the JIT buffer is 8-byte aligned, which allows the padding math to correctly align the target field. The patch has been applied to the stable kernel tree [1][2][3][4]. Users should update to a kernel version containing this commit to mitigate the vulnerability.