riscv: patch: fix handling of bpf-jit execmem addresses

{
  "id": "b83f9aa9f26913b4ed4cdbba0a6baa0215c25ccbc0d19856c21349ee97e34474",
  "url": "https://www.cve.org/CVERecord?id=CVE-2026-99092",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "riscv: patch: fix handling of bpf-jit execmem addresses",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: riscv: patch: fix handling of bpf-jit execmem addresses Commit 8718e5a3090b (\"riscv: patch: skip fixmap mapping when kernel text is already writable\") gated the core_kernel_text() branch of patch_map() on CONFIG_STRICT_KERNEL_RWX, and explicitly left the vmalloc branch unchanged. That branch has a separate problem. That branch only creates a temporary writable fixmap alias when CONFIG_STRICT_MODULE_RWX is enabled, and otherwise assumes the target is directly writable and returns the address unchanged. That assumption no longer holds: bpf_prog_pack_alloc calls set_memory_rox() on every pack unconditionally in alloc_new_pack(), independently of any CONFIG_STRICT_*_RWX option, so BPF text in the vmalloc area is read-only regardless of what CONFIG_STRICT_MODULE_RWX says. With CONFIG_STRICT_MODULE_RWX=n, patch_map() returns the read-only address directly, the subsequent copy_to_kernel_nofault() takes a page fault and returns -EFAULT. bpf_arch_text_copy() turns that into -EINVAL, which propagates through bpf_jit_binary_pack_finalize() to the WARN_ON() in bpf_int_jit_compile() and leaves the program un-JITed. Note that BPF cannot be fixed the way kprobes was in commit bdc46e507b59 (\"riscv: mm: make EXECMEM_KPROBES writable without CONFIG_STRICT_MODULE_RWX\"). EXECMEM_BPF is already PAGE_KERNEL, i.e. writable at allocation time; the read-only mapping is established afterwards by generic code in alloc_new_pack(), which",
    "evidence": "cve:CVE-2026-99092",
    "products": [
      {
        "name": {
          "value": "Linux",
          "evidence": "/containers/cna/affected/0/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      },
      {
        "name": {
          "value": "Linux",
          "evidence": "/containers/cna/affected/1/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2026-99092",
      "aliases": [
        "CVE-2026-99092"
      ],
      "metrics": [],
      "affected": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2c9e5d4a008293407836d29d35dfd4353615bd2f",
              "lessThan": "562a35b9e0b3d9483d9472995219cadb3592db3d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2c9e5d4a008293407836d29d35dfd4353615bd2f",
              "lessThan": "9e8fc7972b398e9dc2415ece283d8f64edac3858",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2c9e5d4a008293407836d29d35dfd4353615bd2f",
              "lessThan": "f71d6ea3843c8038c431c2699482f246aea37ca0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2c9e5d4a008293407836d29d35dfd4353615bd2f",
              "lessThan": "a510e1ae8c9030750c2edf7b0bc9b186cd8c7a06",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "arch/riscv/kernel/patch.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.10",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.58",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "arch/riscv/kernel/patch.c"
          ],
          "defaultStatus": "affected"
        }
      ],
      "modified": "2026-10-26T14:52:00.860Z",
      "provider": "cve",
      "references": [
        "https://git.kernel.org/stable/c/562a35b9e0b3d9483d9472995219cadb3592db3d",
        "https://git.kernel.org/stable/c/9e8fc7972b398e9dc2415ece283d8f64edac3858",
        "https://git.kernel.org/stable/c/f71d6ea3843c8038c431c2699482f246aea37ca0",
        "https://git.kernel.org/stable/c/a510e1ae8c9030750c2edf7b0bc9b186cd8c7a06"
      ],
      "provider_metadata": {
        "cna": {
          "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "shortName": "Linux",
          "dateUpdated": "2026-10-26T14:52:00.860Z"
        }
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-99092",
        "evidence": "/cveMetadata/cveId"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-cve",
  "document_id": 311609,
  "published_at": "2026-10-26T14:52:00.86+00:00"
}