CVE-2026-89906
HighIn the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Refactor jump offset calculation in tail call The old macro-based jmp_offset calculation derives the jump distance from a stale prior-pass code stride, which can lead to wrong branch offsets and soft lockups under extra JIT passes. Fix this by calculating the offset directly on the absolute target: "ctx->offset[insn + 1] - ctx->idx". To avoid a false 16-bit range check abort during size estimation, add a "ctx->image == NULL" guard to inject a safe dummy offset.
CVSS 3.1 score
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected versions
Linux kernel versions
6.1.149,
6.6.103,
6.12.43,
6.15.11,
6.16.2,
6.17
and later are affected. Fixed in
6.18.51,
7.2.5,
7.3-rc1
and their respective stable series.
References
3 totalFrequently asked questions
-
What is CVE-2026-89906?
CVE-2026-89906 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10 . It affects Linux kernel versions from 6.1.149 onward and has been patched in 6.18.51, 7.2.5 and 7.3-rc1. CVE-2026-89906 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
What is the CVSS score for CVE-2026-89906?
CVE-2026-89906 has a CVSS score of 7.8 out of 10, rated High severity (CVSS 3.1). The vector string is
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. -
Is there a patch available for CVE-2026-89906?
Yes. CVE-2026-89906 has been patched. Fixed versions include 6.18.51, 7.2.5 and 7.3-rc1. If you are running Linux kernel 6.1.149 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-89906 actively exploited?
No. CVE-2026-89906 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.