CVE-2026-23383: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23383 is a memory alignment vulnerability in the Linux kernel's BPF JIT compiler for ARM64 architectures, titled "bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing." The flaw affects Linux kernel versions 6.0.1 through 6.12.76, 6.13 through 6.18.16, 6.19 through 6.19.6, and 7.0-rc1. It was disclosed on March 25, 2026, with patches released for stable kernel versions shortly after. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-468 (Incorrect Pointer Scaling) — specifically, the BPF JIT allocator in bpf_jit_binary_pack_alloc() requests only 4-byte alignment (sizeof(u32)) for the JIT buffer, while struct bpf_plt contains a u64 target field requiring 8-byte alignment. When the JIT buffer base address is 4-byte aligned (e.g., ending in 0x4 or 0xc), the relative padding logic in build_plt() fails to place target on an 8-byte boundary. On ARM64, 64-bit loads/stores are only guaranteed to be single-copy atomic when 64-bit aligned; because target is concurrently updated via WRITE_ONCE() in bpf_arch_text_poke() while JIT'd code executes ldr, a misaligned target risks a torn read. The fix increases the allocation alignment to 8 bytes (sizeof(u64)) in bpf_jit_binary_pack_alloc() (Red Hat Bugzilla, Kernel Patch 1).

Successful exploitation of this vulnerability on ARM64 systems can result in the BPF JIT engine jumping to a corrupted or partially-written address due to a torn read of the misaligned target field, potentially enabling arbitrary code execution in kernel context. Additionally, the misalignment triggers UBSAN misaligned-access warnings and can cause unpredictable kernel behavior or system crashes, impacting availability. The vulnerability affects confidentiality, integrity, and availability at a high level, and exploitation requires only low-privileged local access with no user interaction (Red Hat Advisory).

Update the Linux kernel to a patched version: 6.12.77 or later, 6.18.17 or later, 6.19.7 or later, or 7.0-rc2 or later. Patches are available via the upstream stable kernel tree (Kernel Patch 1, Kernel Patch 2, Kernel Patch 3, Kernel Patch 4). As a workaround where patching is not immediately possible, restrict BPF program loading by limiting CAP_BPF and CAP_SYS_ADMIN capabilities to trusted users only, or disable BPF functionality entirely if not required. Distribution-specific updates are available from SUSE, Amazon Linux 2023, and openSUSE.