CVE-2026-97944 (GCVE-0-2026-97944)
Vulnerability from cvelistv5
Published
2026-09-25 10:22
Modified
2026-10-19 09:11
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash() The switch of the FineIBT preamble from "subl $hash, %r10d" to the shorter "subl $hash, %eax" moved the hash immediate from offset 7 to offset 5 of the preamble. fineibt_preamble_hash was updated to match, but the open-coded offset in cfi_get_func_hash() was missed and it still reads the hash at offset 7. cfi_get_func_hash() is used by the BPF JIT to give a struct_ops trampoline the CFI hash of the stub function it stands in for. With FineIBT the trampoline now gets the upper half of the real hash followed by the first two bytes of the next instruction, so the first indirect call from the kernel into a struct_ops program, tcp_init_congestion_control() calling ->init() of a BPF congestion control for example, fails the FineIBT check and the kernel dies with a CFI failure. Move the FineIBT preamble template and its offset defines above cfi_get_func_hash() and use fineibt_preamble_hash there, so every reader of the preamble shares one definition of its layout. The CFI_FINEIBT arm is only built with CONFIG_FINEIBT, the only configuration in which cfi_mode can take that value. cfi_get_func_arity() does not need the same treatment: the __bhi_args call whose displacement it reads still ends at the function address.
References
Impacted products
Vendor Product Version
Linux Linux Version: 85a2d4a890dce3cfc9c14aa91afc3dd7af8e3bf5
Version: 85a2d4a890dce3cfc9c14aa91afc3dd7af8e3bf5
Version: 85a2d4a890dce3cfc9c14aa91afc3dd7af8e3bf5
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/alternative.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cd9b4595d6283f9b8a35d7ae607508de45a351ce",
              "status": "affected",
              "version": "85a2d4a890dce3cfc9c14aa91afc3dd7af8e3bf5",
              "versionType": "git"
            },
            {
              "lessThan": "67cf94c30a8b5ebc839f282f5c5a522b35903524",
              "status": "affected",
              "version": "85a2d4a890dce3cfc9c14aa91afc3dd7af8e3bf5",
              "versionType": "git"
            },
            {
              "lessThan": "5a5d26f2cfe13467166219f6bf58099326912ddb",
              "status": "affected",
              "version": "85a2d4a890dce3cfc9c14aa91afc3dd7af8e3bf5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/alternative.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/cfi: Fix FineIBT hash offset in cfi_get_func_hash()\n\nThe switch of the FineIBT preamble from \"subl $hash, %r10d\" to the\nshorter \"subl $hash, %eax\" moved the hash immediate from offset 7 to\noffset 5 of the preamble. fineibt_preamble_hash was updated to match,\nbut the open-coded offset in cfi_get_func_hash() was missed and it\nstill reads the hash at offset 7.\n\ncfi_get_func_hash() is used by the BPF JIT to give a struct_ops\ntrampoline the CFI hash of the stub function it stands in for. With\nFineIBT the trampoline now gets the upper half of the real hash\nfollowed by the first two bytes of the next instruction, so the first\nindirect call from the kernel into a struct_ops program,\ntcp_init_congestion_control() calling -\u003einit() of a BPF congestion\ncontrol for example, fails the FineIBT check and the kernel dies with\na CFI failure.\n\nMove the FineIBT preamble template and its offset defines above\ncfi_get_func_hash() and use fineibt_preamble_hash there, so every\nreader of the preamble shares one definition of its layout. The\nCFI_FINEIBT arm is only built with CONFIG_FINEIBT, the only\nconfiguration in which cfi_mode can take that value.\ncfi_get_func_arity() does not need the same treatment: the __bhi_args\ncall whose displacement it reads still ends at the function address."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:11:10.690Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cd9b4595d6283f9b8a35d7ae607508de45a351ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/67cf94c30a8b5ebc839f282f5c5a522b35903524"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a5d26f2cfe13467166219f6bf58099326912ddb"
        }
      ],
      "title": "x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97944",
    "datePublished": "2026-09-25T10:22:55.382Z",
    "dateReserved": "2026-09-25T10:18:58.204Z",
    "dateUpdated": "2026-10-19T09:11:10.690Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.