CVE-2026-68285
Received Received - Intake

Memory Leak in Linux Kernel BPF JIT Subprogram Compilation

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fix memory leak in bpf_jit_free() When bpf_int_jit_compile() is called for subprograms, it returns early during the first pass (!prog->is_func || extra_pass is false), keeping ctx->offset alive for the subsequent extra pass. If JIT compilation fails for a later subprogram, the BPF core aborts and calls bpf_jit_free() to clean up the first subprogram. However, bpf_jit_free() fails to free jit_data->ctx.offset, which causes a memory leak of the JIT context offsets array. So fix this by adding the missing kvfree(jit_data->ctx.offset) in bpf_jit_free().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68285
EUVD
EUVD-2026-55386

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a memory leak vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) JIT compiler for LoongArch architecture. When compiling subprograms, the kernel fails to free allocated memory for JIT context offsets if compilation fails later, causing a memory leak.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF JIT compiler and requires kernel-level inspection. Detection involves checking kernel logs for BPF-related errors or memory leaks. Use commands like dmesg | grep -i bpf or journalctl -k | grep -i bpf to search for related errors. If the kernel version is vulnerable, these logs may show failed JIT compilations or memory leaks.

Impact Analysis

The memory leak could gradually consume system memory over time, potentially leading to degraded performance or system instability if exploited repeatedly. It primarily affects systems using BPF JIT compilation on LoongArch.

Mitigation Strategies

Immediately update the Linux kernel to a patched version that includes the fix for CVE-2026-68285. If updating is not immediately possible, disable BPF JIT compilation by setting net.core.bpf_jit_enable=0 in sysctl or kernel boot parameters to prevent the vulnerable code path from being triggered.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68285. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart