In the Linux kernel, the following vulnerability has been resolved: riscv: patch: fix handling of bpf-jit execmem addresses Commit…

In the Linux kernel, the following vulnerability has been resolved: riscv: patch: fix handling of bpf-jit execmem addresses Commit 8718e5a3090b ("riscv: patch: skip fixmap mapping when kernel text is already writable") gated the corekerneltext() branch of patchmap() on CONFIGSTRICTKERNELRWX, and explicitly left the vmalloc branch unchanged. That branch has a separate problem. That branch only creates a temporary writable fixmap alias when CONFIGSTRICTMODULERWX is enabled, and otherwise assumes the target is directly writable and returns the address unchanged. That assumption no longer holds: bpfprogpackalloc calls setmemoryrox() on every pack unconditionally in allocnewpack(), independently of any CONFIGSTRICTRWX option, so BPF text in the vmalloc area is read-only regardless of what CONFIGSTRICTMODULERWX says. With CONFIGSTRICTMODULERWX=n, patchmap() returns the read-only address directly, the subsequent copytokernelnofault() takes a page fault and returns -EFAULT. bpfarchtextcopy() turns that into EINVAL, which propagates through bpfjitbinarypackfinalize() to the WARNON() in bpfintjitcompile() and leaves the program un-JITed. Note that BPF cannot be fixed the way kprobes was in…

curl https://cve.zerocrew.in/api/cve/CVE-2026-99092