CVE-2026-99092

In the Linux kernel, the following vulnerability has been resolved:

riscv: patch: fix handling of bpf-jit execmem addresses

Commit 8718e5a3090b ("riscv: patch: skip fixmap mapping when kernel text is already writable") gated the core kernel text() branch of patch map() on CONFIG STRICT KERNEL RWX, and explicitly left the vmalloc branch unchanged. That branch has a separate problem.

That branch only creates a temporary writable fixmap alias when CONFIG STRICT MODULE RWX is enabled, and otherwise assumes the target is directly writable and returns the address unchanged. That assumption no longer holds: bpf prog pack alloc calls set memory rox() on every pack unconditionally in alloc new pack(), independently of any CONFIG STRICT * RWX option, so BPF text in the vmalloc area is read-only regardless of what CONFIG STRICT MODULE RWX says.

With CONFIG STRICT MODULE RWX=n, patch map() returns the read-only address directly, the subsequent copy to kernel nofault() takes a page fault and returns -EFAULT. bpf arch text copy() turns that into -EINVAL, which propagates through bpf jit binary pack finalize() to the WARN ON() in bpf int jit compile() and leaves the program un-JITed.

Note that BPF cannot be fixed the way kprobes was in commit bdc46e507b59 ("riscv: mm: make EXECMEM KPROBES writable without CONFIG STRICT MODULE RWX"). EXECMEM BPF is already PAGE KERNEL, i.e. writable at allocation time; the read-only mapping is established afterwards by generic code in alloc new pack(), which arch code cannot influence. The only place this can be handled is patch map().

This is the same problem that was fixed on arm64 by commit b1480ed230ac ("arm64: patching: fix handling of execmem addresses"), and the fix is the same: CONFIG EXECMEM is what actually tracks whether the vmalloc area can hold executable memory that needs a temporary alias to be written. CONFIG BPF JIT, CONFIG KPROBES and CONFIG MODULES all select it.

Note that this is not limited to CONFIG MODULES=n. Unlike arm64, riscv selects CONFIG ARCH OPTIONAL KERNEL RWX, so CONFIG STRICT MODULE RWX can be disabled with CONFIG MODULES=y as well, and the bug is reachable in that configuration too.

The !CONFIG MMU build is unaffected: it has its own patch insn set() and patch insn write() implementations and never calls patch map().