CVE-2026-23417: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23417 is a constant blinding bypass vulnerability in the Linux kernel's eBPF (BPF) JIT compiler. Specifically, BPF_ST | BPF_PROBE_MEM32 immediate stores are not handled by bpf_jit_blind_insn(), allowing user-controlled 32-bit immediates to survive unblinded into JIT-compiled native code when kernel hardening is enabled (bpf_jit_harden >= 1). Affected versions include Linux kernel 6.9.1 through 6.12.79, 6.13 through 6.18.20, 6.19 through 6.19.10, and 7.0-rc1 through 7.0-rc7. The vulnerability was published on April 2, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory).

The root cause is a missing case in the bpf_jit_blind_insn() function (related to CWE-693: Protection Mechanism Failure). During BPF program verification, convert_ctx_accesses() rewrites BPF_ST|BPF_MEM instructions to BPF_ST|BPF_PROBE_MEM32 for arena pointer stores. However, when bpf_jit_blind_constants() subsequently runs during JIT compilation, the blinding switch only matches BPF_ST|BPF_MEM (mode 0x60) and not BPF_ST|BPF_PROBE_MEM32 (mode 0xa0), causing the instruction to fall through unblinded. The fix adds BPF_ST|BPF_PROBE_MEM32 cases to bpf_jit_blind_insn(), loading the blinded immediate into BPF_REG_AX via mov+xor and converting the immediate store to a register store (BPF_STX) while preserving the BPF_PROBE_MEM32 mode for correct arena addressing (R12-based on x86-64) (GitHub Advisory).

A local attacker with low privileges could exploit this vulnerability to load eBPF programs containing unblinded constants, potentially bypassing JIT hardening protections intended to prevent exploitation of kernel memory. This could lead to information disclosure or facilitate arbitrary code execution within the kernel through arena pointer manipulation. The availability impact is rated High, while confidentiality and integrity impacts are rated None per the CVSS scoring, though the practical risk of chaining this bypass with other kernel vulnerabilities is non-trivial (GitHub Advisory).

Patches are available in Linux kernel versions 6.12.80+, 6.18.21+, 6.19.11+, and 7.0-rc5+, with upstream commits available at the kernel stable tree (GitHub Advisory). Downstream distributions including Debian, Amazon Linux 2023, SUSE, and openSUSE have released updated packages incorporating the fix. As an interim workaround, administrators should restrict unprivileged eBPF program loading by setting kernel.unprivileged_bpf_disabled = 1 via sysctl, which prevents low-privileged users from loading eBPF programs entirely. Ensure bpf_jit_harden >= 1 remains enabled as a defense-in-depth measure even after patching.

The vulnerability was announced via the Linux kernel CVE announcement mailing list and tracked by multiple downstream vendors including Debian, Amazon Linux, SUSE, and the Yocto Project, all of which issued security updates. Tenable published multiple Nessus detection plugins (IDs 312152, 318102, 318240, 319659) and Qualys added detection (ID 762889). No notable independent researcher commentary or significant social media discussion has been observed beyond routine CVE tracking.