CVE-2026-89906
Last modified
CVE-2026-89906 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Refactor jump offset calculation in tail call The old macro-based jmp_offset calculation derives the jump distance from a stale prior-pass code stride, which can lead to wrong branch offsets and soft lockups under extra JIT passes. Fix this by calculating the offset directly on the absolute target: "ctx->offset[insn + 1] - ctx->idx". To avoid a false 16-bit range check abort during size estimation, add a "ctx->image == NULL" guard to inject a safe dummy offset..
Description
In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Refactor jump offset calculation in tail call The old macro-based jmp_offset calculation derives the jump distance from a stale prior-pass code stride, which can lead to wrong branch offsets and soft lockups under extra JIT passes. Fix this by calculating the offset directly on the absolute target: "ctx->offset[insn + 1] - ctx->idx". To avoid a false 16-bit range check abort during size estimation, add a "ctx->image == NULL" guard to inject a safe dummy offset.
Metrics
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3, < 882b8912b7e92341fdb115ba0e2e5142a28684ff; >= cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3, < 96f44d493c280ea161569c43d7ed0f3b0815803a; >= cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3, < 37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8; 1a782fa32e644aa9fbae6c8488f3e61221ac96e1; 17c010fe45def335fe03a0718935416b04c7f349; f83d469e16bb1f75991ca67c56786fb2aaa42bea; f2b5e50cc04d7a049b385bc1c93b9cbf5f10c94f; 9262e3e04621558e875eb5afb5e726b648cd5949; >= 6.1.149, < 6.2; >= 6.6.103, < 6.7; >= 6.12.43, < 6.13; >= 6.15.11, < 6.16; >= 6.16.2, < 6.17 |
| Linux | Linux | 6.17 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-89906?
How severe is CVE-2026-89906?
How do I fix CVE-2026-89906?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-89900In the Linux kernel, the following vulnerability has been re…
- CVE-2026-89901In the Linux kernel, the following vulnerability has been re…
- CVE-2026-89902In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-89903In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-89904In the Linux kernel, the following vulnerability has been re…8.4
- CVE-2026-89905In the Linux kernel, the following vulnerability has been re…
- CVE-2026-89907In the Linux kernel, the following vulnerability has been re…8.8
- CVE-2026-89908In the Linux kernel, the following vulnerability has been re…8.8
- CVE-2026-89909In the Linux kernel, the following vulnerability has been re…
- CVE-2026-8991The Drag and Drop Multiple File Upload for Contact Form 7 pl…4.4
- CVE-2026-89910In the Linux kernel, the following vulnerability has been re…7.3
- CVE-2026-89911In the Linux kernel, the following vulnerability has been re…7.9
Are you affected by CVE-2026-89906?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST