CVE-2026-23417
BPF JIT Constant Blinding Bypass in Linux Kernel Fixed
Publication date: 2026-04-02
Last updated on: 2026-04-24
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.9 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.21 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.11 (exc) |
| linux | linux_kernel | From 6.9.1 (inc) to 6.12.80 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's BPF (Berkeley Packet Filter) JIT compilation process. Specifically, certain BPF instructions that store 32-bit immediate values (BPF_ST | BPF_PROBE_MEM32) are not properly 'blinded' or obfuscated during JIT compilation when the bpf_jit_harden setting is enabled. This happens because the blinding function only handles BPF_ST | BPF_MEM instructions but misses the BPF_PROBE_MEM32 variant. As a result, user-controlled immediate values can remain unblinded in the compiled native code, potentially exposing sensitive data or enabling exploitation.
The root cause is that during verification, some instructions are rewritten from BPF_ST|BPF_MEM to BPF_ST|BPF_PROBE_MEM32, but the blinding logic does not account for this change. The fix involves adding handling for BPF_PROBE_MEM32 cases in the blinding function to ensure these immediate values are properly obfuscated before execution.
How can this vulnerability impact me? :
Because user-controlled 32-bit immediate values can survive unblinded in JIT-compiled code, an attacker might exploit this to leak sensitive information or manipulate the behavior of the kernel in unintended ways. This could lead to security issues such as information disclosure or privilege escalation depending on how the BPF programs are used.