CVE-2026-23417
published 2026-04-02CVE-2026-23417: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix constant blinding for PROBE_MEM32 stores BPF_ST | BPF_PROBE_MEM32 immediate stores…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.12%
1.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix constant blinding for PROBE_MEM32 stores
BPF_ST | BPF_PROBE_MEM32 immediate stores are not handled by
bpf_jit_blind_insn(), allowing user-controlled 32-bit immediates to
survive unblinded into JIT-compiled native code when bpf_jit_harden >= 1.
The root cause is that convert_ctx_accesses() rewrites BPF_ST|BPF_MEM
to BPF_ST|BPF_PROBE_MEM32 for arena pointer stores during verification,
before bpf_jit_blind_constants() runs during JIT compilation. The
blinding switch only matches BPF_ST|BPF_MEM (mode 0x60), not
BPF_ST|BPF_PROBE_MEM32 (mode 0xa0). The instruction falls through
unblinded.
Add BPF_ST|BPF_PROBE_MEM32 cases to bpf_jit_blind_insn() alongside the
existing BPF_ST|BPF_MEM cases. The blinding transformation is identical:
load the blinded immediate into BPF_REG_AX via mov+xor, then convert
the immediate store to a register store (BPF_STX).
The rewritten STX instruction must preserve the BPF_PROBE_MEM32 mode so
the architecture JIT emits the correct arena addressing (R12-based on
x86-64). Cannot use the BPF_STX_MEM() macro here because it hardcodes
BPF_MEM mode; construct the instruction directly instead.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.19.11-1 (sid) | linux 6.19.11-1 (sid) |
| linux | linux | — | — |
| linux | linux | >= 6082b6c328b5486da2b356eae94b8b83c98b5565 < 56af722756ed82fee2ae5d5b4d04743407506195 | 56af722756ed82fee2ae5d5b4d04743407506195 |
| linux | linux | >= 6082b6c328b5486da2b356eae94b8b83c98b5565 < ccbf29b28b5554f9d65b2fb53b994673ad58b3bf | ccbf29b28b5554f9d65b2fb53b994673ad58b3bf |
| linux | linux | >= 6082b6c328b5486da2b356eae94b8b83c98b5565 < de641ea08f8fff6906e169d2576c2ac54e562fbb | de641ea08f8fff6906e169d2576c2ac54e562fbb |
| linux | linux | >= 6082b6c328b5486da2b356eae94b8b83c98b5565 < 2321a9596d2260310267622e0ad8fbfa6f95378f | 2321a9596d2260310267622e0ad8fbfa6f95378f |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 6.13 < 6.18.21 | 6.18.21 |
| linux | linux_kernel | >= 6.19 < 6.19.11 | 6.19.11 |
| linux | linux_kernel | >= 6.9.1 < 6.12.80 | 6.12.80 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat5.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 6.12.79/6.18.20/6.19.10/7.0-rc4 bpf bpf_jit_blind_insn privilege escalation (EUVD-2026-18200 / Nessus ID 318102)
vuldb·2026-06-24·CVSS 5.5
CVE-2026-23417 [MEDIUM] Linux Kernel up to 6.12.79/6.18.20/6.19.10/7.0-rc4 bpf bpf_jit_blind_insn privilege escalation (EUVD-2026-18200 / Nessus ID 318102)
A vulnerability described as critical has been identified in Linux Kernel up to 6.12.79/6.18.20/6.19.10/7.0-rc4. The impacted element is the function bpf_jit_blind_insn of the component bpf. Executing a manipulation can lead to privilege escalation.
This vulnerability is handled as CVE-2026-23417. The attack can only be done within the local network. There is not any exploit available.
Upgrading the affected component is recommended.
OSV
CVE-2026-23417: (In the Linux kernel, the following vulnerability has been resolved: b
osv·2026-04-03
CVE-2026-23417 CVE-2026-23417: (In the Linux kernel, the following vulnerability has been resolved: b
(In the Linux kernel, the following vulnerability has been resolved: b ...)
OSV
CVE-2026-23417: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix constant blinding for PROBE_MEM32 stores BPF_ST | BPF_PROBE_MEM32 immedia
osv·2026-04-02
CVE-2026-23417 CVE-2026-23417: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix constant blinding for PROBE_MEM32 stores BPF_ST | BPF_PROBE_MEM32 immedia
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix constant blinding for PROBE_MEM32 stores BPF_ST | BPF_PROBE_MEM32 immediate stores are not handled by bpf_jit_blind_insn(), allowing user-controlled 32-bit immediates to survive unblinded into JIT-compiled native code when bpf_jit_harden >= 1. The root cause is that convert_ctx_accesses() rewrites BPF_ST|BPF_MEM to BPF_ST|BPF_PROBE_MEM32 for arena pointer stores during verification, before bpf_jit_blind_constants() runs during JIT compilation. The blinding switch only matches BPF_ST|BPF_MEM (mode 0x60), not BPF_ST|BPF_PROBE_MEM32 (mode 0xa0). The instruction falls through unblinded. Add BPF_ST|BPF_PROBE_MEM32 cases to bpf_jit_blind_insn() alongside the existing BPF_ST|BPF_MEM cases. The blinding transformation is
GHSA
GHSA-3j46-wx9h-x693: In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix constant blinding for PROBE_MEM32 stores
BPF_ST | BPF_PROBE_MEM32 immed
ghsa_unreviewed·2026-04-02
CVE-2026-23417 GHSA-3j46-wx9h-x693: In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix constant blinding for PROBE_MEM32 stores
BPF_ST | BPF_PROBE_MEM32 immed
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix constant blinding for PROBE_MEM32 stores
BPF_ST | BPF_PROBE_MEM32 immediate stores are not handled by
bpf_jit_blind_insn(), allowing user-controlled 32-bit immediates to
survive unblinded into JIT-compiled native code when bpf_jit_harden >= 1.
The root cause is that convert_ctx_accesses() rewrites BPF_ST|BPF_MEM
to BPF_ST|BPF_PROBE_MEM32 for arena pointer stores during verification,
before bpf_jit_blind_constants() runs during JIT compilation. The
blinding switch only matches BPF_ST|BPF_MEM (mode 0x60), not
BPF_ST|BPF_PROBE_MEM32 (mode 0xa0). The instruction falls through
unblinded.
Add BPF_ST|BPF_PROBE_MEM32 cases to bpf_jit_blind_insn() alongside the
existing BPF_ST|BPF_MEM cases. The blinding transformation
Red Hat
kernel: bpf: Fix constant blinding for PROBE_MEM32 stores
vendor_redhat·2026-04-02·CVSS 5.5
CVE-2026-23417 [LOW] CWE-807 kernel: bpf: Fix constant blinding for PROBE_MEM32 stores
kernel: bpf: Fix constant blinding for PROBE_MEM32 stores
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix constant blinding for PROBE_MEM32 stores
BPF_ST | BPF_PROBE_MEM32 immediate stores are not handled by
bpf_jit_blind_insn(), allowing user-controlled 32-bit immediates to
survive unblinded into JIT-compiled native code when bpf_jit_harden >= 1.
The root cause is that convert_ctx_accesses() rewrites BPF_ST|BPF_MEM
to BPF_ST|BPF_PROBE_MEM32 for arena pointer stores during verification,
before bpf_jit_blind_constants() runs during JIT compilation. The
blinding switch only matches BPF_ST|BPF_MEM (mode 0x60), not
BPF_ST|BPF_PROBE_MEM32 (mode 0xa0). The instruction falls through
unblinded.
Add BPF_ST|BPF_PROBE_MEM32 cases to bpf_jit_blind_insn() alongside the
exi
Debian
CVE-2026-23417: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix co...
vendor_debian·2026
CVE-2026-23417 [LOW] CVE-2026-23417: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix co...
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix constant blinding for PROBE_MEM32 stores BPF_ST | BPF_PROBE_MEM32 immediate stores are not handled by bpf_jit_blind_insn(), allowing user-controlled 32-bit immediates to survive unblinded into JIT-compiled native code when bpf_jit_harden >= 1. The root cause is that convert_ctx_accesses() rewrites BPF_ST|BPF_MEM to BPF_ST|BPF_PROBE_MEM32 for arena pointer stores during verification, before bpf_jit_blind_constants() runs during JIT compilation. The blinding switch only matches BPF_ST|BPF_MEM (mode 0x60), not BPF_ST|BPF_PROBE_MEM32 (mode 0xa0). The instruction falls through unblinded. Add BPF_ST|BPF_PROBE_MEM32 cases to bpf_jit_blind_insn() alongside the existing BPF_ST|BPF_MEM cases. The blinding transformation is
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-23417 kernel: bpf: Fix constant blinding for PROBE_MEM32 stores
bugzilla·2026-04-02·CVSS 5.5
CVE-2026-23417 [MEDIUM] CVE-2026-23417 kernel: bpf: Fix constant blinding for PROBE_MEM32 stores
CVE-2026-23417 kernel: bpf: Fix constant blinding for PROBE_MEM32 stores
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix constant blinding for PROBE_MEM32 stores
BPF_ST | BPF_PROBE_MEM32 immediate stores are not handled by
bpf_jit_blind_insn(), allowing user-controlled 32-bit immediates to
survive unblinded into JIT-compiled native code when bpf_jit_harden >= 1.
The root cause is that convert_ctx_accesses() rewrites BPF_ST|BPF_MEM
to BPF_ST|BPF_PROBE_MEM32 for arena pointer stores during verification,
before bpf_jit_blind_constants() runs during JIT compilation. The
blinding switch only matches BPF_ST|BPF_MEM (mode 0x60), not
BPF_ST|BPF_PROBE_MEM32 (mode 0xa0). The instruction falls through
unblinded.
Add BPF_ST|BPF_PROBE_MEM32 cases to bpf_jit_blind_insn(
Wiz
CVE-2026-23417 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2026-23417 CVE-2026-23417 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-23417 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix constant blinding for PROBE_MEM32 stores
BPF_ST | BPF_PROBE_MEM32 immediate stores are not handled by
bpf_jit_blind_insn(), allowing user-controlled 32-bit immediates to
survive unblinded into JIT-compiled native code when bpf_jit_harden >= 1.
The root cause is that convert_ctx_accesses() rewrites BPF_ST|BPF_MEM
to BPF_ST|BPF_PROBE_MEM32 for arena pointer stores during verification,
before bpf_jit_blind_constants() runs during JIT compilation. The
blinding switch only matches BPF_ST|BPF_MEM (mode 0x60), not
BPF_ST|BPF_PROBE_MEM32 (mode 0xa0). The instruction falls through
unblinded.
Add BPF_ST|BPF_PROBE_MEM32 cases to bpf_jit_blind_insn()
2026-04-02
Published