A high-severity vulnerability in the Linux kernel LoongArch BPF JIT compiler could allow a local authenticated attacker to achieve code execution or system instability by exploiting inconsistent register state.

The vulnerability exists in the LoongArch JIT compiler for BPF, which performs improper sign-extension on 32-bit division and modulo operations. This mismatch allows an authenticated local user with low privileges to trigger an incorrect register state that deviates from the BPF verifier model, potentially leading to unauthorized memory access or arbitrary code execution.

The vulnerability carries a CVSS score of 7.8, indicating a high risk to system integrity and confidentiality. While the attack requires local access, successful exploitation enables a low-privileged user to escalate privileges or bypass kernel-level protections, leading to full system compromise. This poses a significant threat to environments relying on BPF for sandboxing or network filtering.

Immediate Action: Update the Linux kernel to version 7.1.6 or later, which contains the necessary patches to correctly zero-extend ALU32 results.

Proactive Monitoring: Monitor system logs for unusual kernel crashes or BPF verifier errors that may indicate an attacker attempting to trigger this specific register mismatch.

Compensating Controls: Restrict access to BPF-related system calls for non-privileged users to limit the attack surface while the kernel update is pending deployment.

Public Exploit Available: Unknown

Given the potential for privilege escalation and the high CVSS rating, organizations running the Linux kernel on LoongArch hardware should prioritize the transition to version 7.1.6. System administrators must ensure that kernel updates are validated in a staging environment before full deployment to maintain operational stability. Immediate patching is the only effective way to neutralize the risk posed by this incorrect register handling.