high · CVSS v3 7.1
CVE-2026-93147
A bug in the Linux kernel’s s390 BPF implementation allowed the 32‑bit CPU number to be loaded into a 64‑bit BPF register without clearing t
Overview
A bug in the Linux kernel’s s390 BPF implementation allowed the 32‑bit CPU number to be loaded into a 64‑bit BPF register without clearing the upper bits. This can cause unintended data leakage or incorrect BPF program execution.
Description
In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Replace ly instruction with llgf cpu_nr is a 32 bit value and BPF_REG_0 is a 64 bit register, when ly loads the cpu_nr into BPF_REG_0 it does not zero the upper bits, but llgf does.
Impact
{'confidentiality': 'Potential leakage of kernel data via BPF registers.', 'integrity': 'BPF programs may read or write unintended memory, compromising kernel integrity.', 'availability': 'Faulty BPF execution could trigger crashes or hangs, affecting system availability.'}
Remediation
['Apply the latest kernel update that includes the s390 BPF ly/llgf fix.', 'Verify that all distributions have applied the patch; use `uname -r` to confirm kernel version.', 'If immediate patching is not possible, restrict BPF program loading or disable BPF on s390 nodes until the fix is deployed.', 'Monitor kernel logs for BPF-related errors or crashes.']
Risk context
High severity (CVSS 7.1). No EPSS data available. The vulnerability is exploitable only if an attacker can inject or modify BPF programs, which is typically restricted to privileged users. Prompt patching is recommended to eliminate the risk.
Affected products
- Linux kernel
- Ubuntu
- RedHat
- Debian
- SUSE
- Fedora
- Oracle Linux
- CentOS
Scores
- Severity
- high
- CVSS v2
- 3.6
- CVSS v3
- 7.1
- CVSS v4
- —
- EPSS
- —