{"id":33342,"date":"2026-10-06T20:31:49","date_gmt":"2026-10-06T12:31:49","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98273"},"modified":"2026-10-06T20:31:49","modified_gmt":"2026-10-06T12:31:49","slug":"cve-2026-98273","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98273","title":{"rendered":"CVE-2026-98273 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nx86\/kprobes: Fix cras"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>x86\/kprobes: Fix crash when probing CS CALL instructions<\/p>\n<p>When using eBPF to probe CS CALL instructions within a function,<br \/>\na crash can be triggered.<\/p>\n<p>The eBPF tool probes offset 257 of the __hrtimer_run_queues()<br \/>\nfunction:<\/p>\n<p>:  nopl   0x0(%rax,%rax,1)<br \/>\n:  mov    %r14,%rdi<br \/>\n:  cs call<br \/>\n:  mov    %eax,%r12d<br \/>\n:  xchg   %ax,%ax<br \/>\n:  mov    %r13,%rdi<\/p>\n<p>Which triggers this crash:<\/p>\n<p>  BUG: unable to handle page fault for address: 00000000000f41c9<br \/>\n  #PF: supervisor write access in kernel mode<br \/>\n  #PF: error_code(0x0002) &#8211; not-present page<br \/>\n  PGD 0 P4D 0<br \/>\n  Oops: 0002 [#1] SMP NOPTI<br \/>\n  CPU: 1 PID: 0 Comm: swapper\/1 Kdump: loaded Tainted: P<br \/>\n  RIP: 0010:__hrtimer_run_queues+0x106\/0x230<\/p>\n<p>Note that __hrtimer_run_queues+0x106 is __hrtimer_run_queues+262, which is<br \/>\nat the 6th byte of the above CS CALL instruction. Since the CS CALL<br \/>\ninstruction occupies 6 bytes, the exception occurred in the middle of that<br \/>\ncall instruction.<\/p>\n<p>The root cause is that when using eBPF tools to probe in the middle of a<br \/>\nfunction, a kprobe with INT3 is used as the underlying implementation.<\/p>\n<p>During single-step emulation of the original CALL instruction,<br \/>\nint3_emulate_call() assumes that the probed CALL instruction is 5 bytes<br \/>\nlong. However, the actual CS-prefixed CALL instruction occupies 6 bytes,<br \/>\nso it constructs an incorrect exception return address. When the CPU<br \/>\nreturns from the kprobe handler, the next instruction to be executed is at<br \/>\nthe address of the last byte of that CS CALL instruction. Coincidentally,<br \/>\nstarting from that address, the CPU fetches and decodes a completely<br \/>\ndifferent instruction, which ultimately triggers a kernel crash.<\/p>\n<p>Fix the issue by using the actual instruction length obtained from<br \/>\nthe instruction decoder when constructing the exception return<br \/>\naddress, rather than relying on the hardcoded CALL_INSN_SIZE macro.<\/p>\n<p>[ mingo: Refined the changelog ]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>x86\/kprobes: Fix crash when probing CS CALL instructions<\/p>\n<p>When using eBPF to probe CS CALL instructions within a function,<br \/>\na crash <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33342","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33342","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33342"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33342"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33342"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}