PT-2026-29724 · Linux · Linux Kernel

Published 2026-04-02 · Updated 2026-04-03 · CVE-2026-23417

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Linux kernel related to BPF ST | BPF PROBE MEM32 immediate stores. Specifically, user-controlled 32-bit immediates could survive unblinded into JIT-compiled native code when bpf jit harden is set to 1. This occurs because the bpf jit blind insn() function did not handle BPF ST|BPF PROBE MEM32 immediate stores, allowing the instruction to fall through unblinded. The issue stems from a rewriting process during verification that changes BPF ST|BPF MEM to BPF ST|BPF PROBE MEM32, but the blinding switch only matched the original mode. The fix involves adding BPF ST|BPF PROBE MEM32 cases to the bpf jit blind insn() function to ensure proper blinding.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-23417

Affected Products

Linux Kernel

References · 15

• https://git.kernel.org/stable/c/ccbf29b28b5554f9d65b2fb53b994673ad58b3bf · Patch
• https://ubuntu.com/security/CVE-2026-23417 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23417 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23417 · Vendor Advisory
• https://git.kernel.org/stable/c/56af722756ed82fee2ae5d5b4d04743407506195 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23417 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-23417 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-23417 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-23417 · Vendor Advisory
• https://git.kernel.org/stable/c/de641ea08f8fff6906e169d2576c2ac54e562fbb · Patch
• https://git.kernel.org/stable/c/2321a9596d2260310267622e0ad8fbfa6f95378f · Patch
• https://docs.bell-sw.com/security/cves/CVE-2026-23417 · Note
• https://git.kernel.org/linus/2321a9596d2260310267622e0ad8fbfa6f95378f · Note
• https://twitter.com/cyberbivash/status/2039697455420203440 · Twitter Post
• https://twitter.com/CVEnew/status/2039744365405393376 · Twitter Post