CVE-2026-23383 bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing
A race condition in the Linux kernel BPF JIT compiler on arm64 can cause torn reads of jump targets, potentially leading to arbitrary code execution or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23383?
CVE-2026-23383 is a high-severity vulnerability in Linux kernel, published on 25 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing
struct bpf_plt contains a u64 target field. Currently, the BPF JIT allocator requests an alignment of 4 bytes (sizeof(u32)) for the JIT buffer.
Because the base address of the JIT buffer can be 4-byte aligned (e.g., ending in 0x4 or 0xc), the relative padding logic in build_plt() fails to ensure that target lands on an 8-byte boundary.
This leads to two issues: 1. UBSAN reports misaligned-access warnings when dereferencing the structure. 2. More critically, target is updated concurrently via WRITE_ONCE() in bpf_arch_text_poke() while the JIT'd code executes ldr. On arm64, 64-bit loads/stores are only guaranteed to be single-copy atomic if they are 64-bit aligned. A misaligned target risks a torn read, causing the JIT to jump to a corrupted address.
Fix this by increasing the allocation alignment requirement to 8 bytes (sizeof(u64)) in bpf_jit_binary_pack_alloc(). This anchors the base of the JIT buffer to an 8-byte boundary, allowing the relative padding math in build_plt() to correctly align the target field.
Which versions are affected by CVE-2026-23383?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23383?
Apply the vendor's patch.
Is CVE-2026-23383 being exploited?
There is no known exploitation of CVE-2026-23383 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-80619, BELL-CVE-2026-23383, DEBIAN-CVE-2026-23383, GHSA-887m-4qrh-hjq5, ROOT-OS-DEBIAN-12-CVE-2026-23383, ROOT-OS-DEBIAN-13-CVE-2026-23383 and 2 more.