Look up another CVE · open CVE-2026-89902 in the interactive tracker
CVE-2026-89902
LoongArch: Avoid preempt count underflow without probe
Published 2026-09-16 (33 days ago) by the Linux kernel CNA. Subsystem arch/loongarch. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-89902 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
LoongArch uses break 11 for the breakpoint placed after an instruction that Kprobes executes out of line. Since userspace can issue the same break instruction, do_bp() can reach kprobe_singlestep_handler() when there is no current probe. The handler actually returns false in this case, but it first calls preempt_enable_no_resched(). The corresponding preempt_disable() is done by kprobe_breakpoint_handler() on a real Kprobe hit, so it has not run here. As a result, an ordinary userspace breakpoint (code 11) underflows the current task's preempt count. This also makes in_interrupt() return true until the task schedules. One visible consequence is the socket cgroup attribution: cgroup_sk_alloc() treats the allocation as interrupt context and assigns the socket to the root cgroup. A socket opened from the SIGTRAP handler can then avoid a BPF_CGROUP_INET_SOCK_CREATE policy attached to the task's own cgroup. Return as soon as kprobe_running() reports no active probe. The same check has appeared in [PATCH v10 2/4] of the original LoongArch Kprobes series, but was dropped before the feature reached mainline.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
arch/loongarch/kernel/kprobes.c
- What this is
- LOONGARCHMAINTAINERS section matched on arch/loongarch/ · loongarch@lists.linux.dev · Maintained
Check it on the machine
grep -w CONFIG_KPROBES /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release with an answer below compiles the affected file into the kernels it ships. The build rule could not be established for 1 release, so nothing is claimed about those.
- bookworm?
- trixie, forky, sid, bookworm · linux-6.12y
- ?
- not established - no Makefile entry for the affected file
- y
- built into the kernel image on every flavour - only a patch removes it
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
- Build switch
- CONFIG_KPROBES
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-16 (33 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.18%, higher than 6.5% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- arch/loongarch
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.3 | 6.6.157 | ff40e597d5d9 |
| 6.3 | 6.12.110 | a1cb727fa27c |
| 6.3 | 6.18.51 | 76395109a051 |
| 6.3 | 7.2.5 | c4357ebeee63 |
| 6.3 | 7.3 | 72ce4b24676e |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- An unprivileged LoongArch process reaches do_bp() then kprobe_singlestep_handler() by executing break 11 (BRK_KPROBE_SSTEPBP). That is a local CPU exception path, not a network protocol, adjacent wireless/Bluetooth frame, or physical device interface.
- AC:LAttack complexity, low
- With no kprobe running on the CPU (the normal case), break 11 always takes the unmatched preempt_enable_no_resched() path and underflows preempt_count. The attacker then calls socket() from their own SIGTRAP handler; no race or victim-controlled state is required.
- PR:LPrivileges required, low
- do_bp() applies no capability or credential check before dispatching BRK_KPROBE_SSTEPBP. Any unprivileged local user who can run code can issue the instruction; init-namespace root and user-namespace capabilities are not required.
- UI:NUser interaction, none
- The attacker executes break 11 in their own process and, for the cgroup bypass, installs their own SIGTRAP handler that creates sockets. No other user must mount a filesystem, open a device, or otherwise cooperate.
- S:UScope, unchanged
- Preempt-count corruption and the resulting socket cgroup/BPF misattribution stay inside the host kernel's security authority. This is not a KVM/Xen guest-to-host escape or an IOMMU/DMA boundary bypass.
- C:HConfidentiality impact, high
- cgroup_sk_alloc() treats the underflow as interrupt context and pins the new socket to the root cgroup, so BPF_CGROUP_INET_SOCK_CREATE and later cgroup bind/connect/egress programs on the task's cgroup do not run. In a container or Cilium-style deployment this bypasses network isolation and can expose protected services.
- I:HIntegrity impact, high
- Root-cgroup attribution skips the container's cgroup BPF socket and traffic hooks for that socket, fully bypassing that access-control policy, while the unmatched preempt_enable corrupts kernel preempt_count used for interrupt and atomic accounting.
- A:HAvailability impact, high
- The underflow makes in_atomic() true, so the next schedule (default SIGTRAP teardown or any blocking syscall) hits BUG: scheduling while atomic and can panic the host, especially with panic_on_warn. mem_cgroup_sk_alloc() also skips container socket charging, allowing host memory exhaustion.