{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "fb7cefabae8117c203155ef169a386bec43bbba9"
            },
            {
              "fixed": "26d9496c826586338d1b8c27edfec4a19a89f462"
            },
            {
              "fixed": "08fe2eaa609180c1baeb76c2629a9c82263b0427"
            },
            {
              "fixed": "5eb8921371c6fd117d4a328b6053dfda38707df8"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.18.0"
            },
            {
              "fixed": "6.18.52"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92517.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, riscv: Fix extable handling for arena load_acquire\n\nemit_atomic_ld_st() returns 1 to have build_body() skip the zext after\na sub-word load_acquire. The caller does \"ret = ret ?:\nadd_exception_handler(...)\", which skips add_exception_handler() on any\nnon-zero ret, so the extable entry is missing and a faulting\nPROBE_ATOMIC load_acquire oopses.\n\nREG_DONT_CLEAR_MARKER leaves rd stale on fault, and the verifier still\nthinks the load overwrote it, so a program can leak it through a map.\n\nCheck ret \u003e= 0 before calling add_exception_handler(), and pass rd for\nLOAD_ACQ so the fault zeroes rd like a PROBE_MEM load. Return ret\nunchanged for the zext skip.",
  "id": "CVE-2026-92517",
  "modified": "2026-09-19T03:30:36.446364364Z",
  "published": "2026-09-17T16:10:25.482Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/08fe2eaa609180c1baeb76c2629a9c82263b0427"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/26d9496c826586338d1b8c27edfec4a19a89f462"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5eb8921371c6fd117d4a328b6053dfda38707df8"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92517.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92517"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "bpf, riscv: Fix extable handling for arena load_acquire"
}