{"api_version":"1","generated_at":"2026-10-01T08:20:56+00:00","cve":"CVE-2026-97944","urls":{"html":"https://cve.report/CVE-2026-97944","api":"https://cve.report/api/cve/CVE-2026-97944.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-97944","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-97944"},"summary":{"title":"x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/cfi: Fix FineIBT hash offset in cfi_get_func_hash()\n\nThe switch of the FineIBT preamble from \"subl $hash, %r10d\" to the\nshorter \"subl $hash, %eax\" moved the hash immediate from offset 7 to\noffset 5 of the preamble. fineibt_preamble_hash was updated to match,\nbut the open-coded offset in cfi_get_func_hash() was missed and it\nstill reads the hash at offset 7.\n\ncfi_get_func_hash() is used by the BPF JIT to give a struct_ops\ntrampoline the CFI hash of the stub function it stands in for. With\nFineIBT the trampoline now gets the upper half of the real hash\nfollowed by the first two bytes of the next instruction, so the first\nindirect call from the kernel into a struct_ops program,\ntcp_init_congestion_control() calling ->init() of a BPF congestion\ncontrol for example, fails the FineIBT check and the kernel dies with\na CFI failure.\n\nMove the FineIBT preamble template and its offset defines above\ncfi_get_func_hash() and use fineibt_preamble_hash there, so every\nreader of the preamble shares one definition of its layout. The\nCFI_FINEIBT arm is only built with CONFIG_FINEIBT, the only\nconfiguration in which cfi_mode can take that value.\ncfi_get_func_arity() does not need the same treatment: the __bhi_args\ncall whose displacement it reads still ends at the function address.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-25 11:17:21","updated_at":"2026-09-25 11:17:21"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/5a5d26f2cfe13467166219f6bf58099326912ddb","name":"https://git.kernel.org/stable/c/5a5d26f2cfe13467166219f6bf58099326912ddb","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/cd9b4595d6283f9b8a35d7ae607508de45a351ce","name":"https://git.kernel.org/stable/c/cd9b4595d6283f9b8a35d7ae607508de45a351ce","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/67cf94c30a8b5ebc839f282f5c5a522b35903524","name":"https://git.kernel.org/stable/c/67cf94c30a8b5ebc839f282f5c5a522b35903524","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-97944","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97944","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 85a2d4a890dce3cfc9c14aa91afc3dd7af8e3bf5 cd9b4595d6283f9b8a35d7ae607508de45a351ce git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 85a2d4a890dce3cfc9c14aa91afc3dd7af8e3bf5 67cf94c30a8b5ebc839f282f5c5a522b35903524 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 85a2d4a890dce3cfc9c14aa91afc3dd7af8e3bf5 5a5d26f2cfe13467166219f6bf58099326912ddb git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.18","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.53 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.7 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc4 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"97944","cve":"CVE-2026-97944","epss":"0.001660000","percentile":"0.051950000","score_date":"2026-09-27","updated_at":"2026-09-28 00:02:24"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/kernel/alternative.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"cd9b4595d6283f9b8a35d7ae607508de45a351ce","status":"affected","version":"85a2d4a890dce3cfc9c14aa91afc3dd7af8e3bf5","versionType":"git"},{"lessThan":"67cf94c30a8b5ebc839f282f5c5a522b35903524","status":"affected","version":"85a2d4a890dce3cfc9c14aa91afc3dd7af8e3bf5","versionType":"git"},{"lessThan":"5a5d26f2cfe13467166219f6bf58099326912ddb","status":"affected","version":"85a2d4a890dce3cfc9c14aa91afc3dd7af8e3bf5","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/kernel/alternative.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.53","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.7","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc4","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.53","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.7","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc4","versionStartIncluding":"6.18","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/cfi: Fix FineIBT hash offset in cfi_get_func_hash()\n\nThe switch of the FineIBT preamble from \"subl $hash, %r10d\" to the\nshorter \"subl $hash, %eax\" moved the hash immediate from offset 7 to\noffset 5 of the preamble. fineibt_preamble_hash was updated to match,\nbut the open-coded offset in cfi_get_func_hash() was missed and it\nstill reads the hash at offset 7.\n\ncfi_get_func_hash() is used by the BPF JIT to give a struct_ops\ntrampoline the CFI hash of the stub function it stands in for. With\nFineIBT the trampoline now gets the upper half of the real hash\nfollowed by the first two bytes of the next instruction, so the first\nindirect call from the kernel into a struct_ops program,\ntcp_init_congestion_control() calling ->init() of a BPF congestion\ncontrol for example, fails the FineIBT check and the kernel dies with\na CFI failure.\n\nMove the FineIBT preamble template and its offset defines above\ncfi_get_func_hash() and use fineibt_preamble_hash there, so every\nreader of the preamble shares one definition of its layout. The\nCFI_FINEIBT arm is only built with CONFIG_FINEIBT, the only\nconfiguration in which cfi_mode can take that value.\ncfi_get_func_arity() does not need the same treatment: the __bhi_args\ncall whose displacement it reads still ends at the function address."}],"providerMetadata":{"dateUpdated":"2026-09-25T10:22:55.382Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/cd9b4595d6283f9b8a35d7ae607508de45a351ce"},{"url":"https://git.kernel.org/stable/c/67cf94c30a8b5ebc839f282f5c5a522b35903524"},{"url":"https://git.kernel.org/stable/c/5a5d26f2cfe13467166219f6bf58099326912ddb"}],"title":"x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash()","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-97944","datePublished":"2026-09-25T10:22:55.382Z","dateReserved":"2026-09-25T10:18:58.204Z","dateUpdated":"2026-09-25T10:22:55.382Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-25 11:17:21","lastModifiedDate":"2026-09-25 11:17:21","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"97944","Ordinal":"1","Title":"x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash()","CVE":"CVE-2026-97944","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"97944","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/cfi: Fix FineIBT hash offset in cfi_get_func_hash()\n\nThe switch of the FineIBT preamble from \"subl $hash, %r10d\" to the\nshorter \"subl $hash, %eax\" moved the hash immediate from offset 7 to\noffset 5 of the preamble. fineibt_preamble_hash was updated to match,\nbut the open-coded offset in cfi_get_func_hash() was missed and it\nstill reads the hash at offset 7.\n\ncfi_get_func_hash() is used by the BPF JIT to give a struct_ops\ntrampoline the CFI hash of the stub function it stands in for. With\nFineIBT the trampoline now gets the upper half of the real hash\nfollowed by the first two bytes of the next instruction, so the first\nindirect call from the kernel into a struct_ops program,\ntcp_init_congestion_control() calling ->init() of a BPF congestion\ncontrol for example, fails the FineIBT check and the kernel dies with\na CFI failure.\n\nMove the FineIBT preamble template and its offset defines above\ncfi_get_func_hash() and use fineibt_preamble_hash there, so every\nreader of the preamble shares one definition of its layout. The\nCFI_FINEIBT arm is only built with CONFIG_FINEIBT, the only\nconfiguration in which cfi_mode can take that value.\ncfi_get_func_arity() does not need the same treatment: the __bhi_args\ncall whose displacement it reads still ends at the function address.","Type":"Description","Title":"x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash()"}]}}}