CVE-2026-97944
Received Received - Intake

x86/cfi FineIBT Hash Offset Miscalculation in Linux Kernel

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash() The switch of the FineIBT preamble from "subl $hash, %r10d" to the shorter "subl $hash, %eax" moved the hash immediate from offset 7 to offset 5 of the preamble. fineibt_preamble_hash was updated to match, but the open-coded offset in cfi_get_func_hash() was missed and it still reads the hash at offset 7. cfi_get_func_hash() is used by the BPF JIT to give a struct_ops trampoline the CFI hash of the stub function it stands in for. With FineIBT the trampoline now gets the upper half of the real hash followed by the first two bytes of the next instruction, so the first indirect call from the kernel into a struct_ops program, tcp_init_congestion_control() calling ->init() of a BPF congestion control for example, fails the FineIBT check and the kernel dies with a CFI failure. Move the FineIBT preamble template and its offset defines above cfi_get_func_hash() and use fineibt_preamble_hash there, so every reader of the preamble shares one definition of its layout. The CFI_FINEIBT arm is only built with CONFIG_FINEIBT, the only configuration in which cfi_mode can take that value. cfi_get_func_arity() does not need the same treatment: the __bhi_args call whose displacement it reads still ends at the function address.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-10-16
AI Q&A
2026-09-25
EPSS Evaluated
2026-10-14
NVD
CVE-2026-97944
EUVD
EUVD-2026-86798

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a mismatch in the FineIBT (Fine-grained Indirect Branch Tracking) preamble hash offset. The issue occurs because the hash immediate offset was changed from 7 to 5 in the preamble, but an open-coded offset in the cfi_get_func_hash() function was not updated, causing it to read the hash at the wrong position. This leads to incorrect CFI (Control Flow Integrity) hash values for BPF JIT trampolines, resulting in failed FineIBT checks during indirect calls and kernel crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel and requires kernel-level inspection. Detection involves checking kernel version and configuration. Use uname -a to verify kernel version and grep CONFIG_FINEIBT /boot/config-$(uname -r) to confirm FineIBT support. If FineIBT is enabled, inspect BPF JIT trampolines for CFI failures during indirect calls.

Impact Analysis

This vulnerability can cause the Linux kernel to crash when executing indirect calls through BPF JIT trampolines, such as during the initialization of BPF congestion control programs. This may lead to system instability, denial of service, or unexpected behavior in systems running affected kernel versions.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a Linux kernel security flaw related to Control Flow Integrity (CFI) and FineIBT checks. It may indirectly impact compliance if systems relying on these features fail to meet security requirements.

Mitigation Strategies

Apply the latest kernel patches from your distribution to resolve the FineIBT hash offset issue. If FineIBT is not required, disable it via kernel command line (add nofineibt to GRUB_CMDLINE_LINUX). Monitor kernel logs for CFI failures post-update to confirm mitigation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97944. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart