bpf: Fix WARNING in bpf_tracing_link_release
CVE-2026-92485 · published 17 Sept 2026
How serious is it
- Severity: high, CVSS score 7.8 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-92485?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: 8f873cc3f67f2257493063e57d0caf07ef889ee9 to < a5c6316052f0ff1467221ecf2996cbab0a496b1e, 2b5dcb31a19a2e0acd869b12c9db9b2d696ef544 to < d02035c5eb4955616efc5c6dbe3d98f19d798cb2, 2b5dcb31a19a2e0acd869b12c9db9b2d696ef544 to < 094f0a895cf97a993d06d5dc4c12e7cb7da845a5, 2b5dcb31a19a2e0acd869b12c9db9b2d696ef544 to < 48a0209d8da0d90a7b0a0db19d1ff88027b13781
- Linux Linux: 6.7
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix WARNING in bpf_tracing_link_release
The trampoline could be corrupted by the blindly
'tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX' in verifier.
1. A fexit attached to a tail_call_reachable prog. 'tr->flags' became
'BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_TAIL_CALL_CTX'. And, the
trampoline would poke the target prog's nop insn using jmp insn instead
of call insn.
2. Another fexit loaded with the same tail_call_reachable prog target.
'tr->flags' became 'BPF_TRAMP_F_TAIL_CALL_CTX'.
3. Close the first fexit link. Due to no BPF_TRAMP_F_CALL_ORIG in
'tr->flags', the trampoline will fail to restore the prog's nop insn
using call insn.
[ 3.410719] WARNING: kernel/bpf/syscall.c:3551 at bpf_tracing_link_release+0x53/0x60, CPU#1: test_progs/98
...
[ 3.428793] bpf_link_free+0x58/0x130
[ 3.429293] bpf_link_release+0x23/0x30
Fix the warning by updating 'tr->flags' with '|=' and lock.
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/a5c6316052f0ff1467221ecf2996cbab0a496b1e
- git.kernel.org/stable/c/d02035c5eb4955616efc5c6dbe3d98f19d798cb2
- git.kernel.org/stable/c/094f0a895cf97a993d06d5dc4c12e7cb7da845a5
- git.kernel.org/stable/c/48a0209d8da0d90a7b0a0db19d1ff88027b13781
- git.kernel.org/stable/c/61aaa8782bec59ecffd22e030f54ef9351bcabf9
Merged from CVE List. Last updated 26 Oct 2026. All vulnerabilities · RSS · JSON