CVE-2026-64508: bpf: Support for hardening against JIT spraying

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

bpf: Support for hardening against JIT spraying

The BPF JIT allocator packs many small programs into larger executable
allocations and reuses space within those allocations as programs are
loaded and freed. When fresh code is written into space that a previous
program occupied, an indirect jump into the new program can reuse a branch
prediction left behind by the old one.

Flush the indirect branch predictors before reusing JIT memory so that
indirect jumps into a newly written program don't reuse predictions from an
old program that occupied the same space.

Introduce bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush
static call for flushing the branch predictors on JIT memory reuse.
Architectures that need a flush, can update it to a predictor flush
function. By default, its a NOP and does not emit any CALL.

Allocations larger than a pack are not covered by this flush. That is safe
because cBPF programs (the unprivileged attack surface) are bounded well
below a pack size. Issue a warning if this assumption is ever violated
while the flush is active.

The Linux kernel CVE team has assigned CVE-2026-64508 to this issue.


Affected and fixed versions
===========================

	Fixed in 6.6.145 with commit 6e52c240c43a601b681e3a4e58fc5685114d4726
	Fixed in 6.12.97 with commit eed774da601268dae674e14d54a15e3624691f52
	Fixed in 6.18.39 with commit 8ff183ee4d8c452960df58175a094828c0513b2e
	Fixed in 7.1.4 with commit 7a6c171c6a1ac6d1509752dac131d941a3de0b37
	Fixed in 7.2-rc2 with commit 96cce16e26dd02a8678f1e87f88a4b5cdb63b995

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64508
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	include/linux/filter.h
	kernel/bpf/core.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/6e52c240c43a601b681e3a4e58fc5685114d4726
	https://git.kernel.org/stable/c/eed774da601268dae674e14d54a15e3624691f52
	https://git.kernel.org/stable/c/8ff183ee4d8c452960df58175a094828c0513b2e
	https://git.kernel.org/stable/c/7a6c171c6a1ac6d1509752dac131d941a3de0b37
	https://git.kernel.org/stable/c/96cce16e26dd02a8678f1e87f88a4b5cdb63b995