In the Linux kernel, the following vulnerability has been resolved: x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash() The switch of the FineIBT preamble from "subl $hash, %r10d" to the shorter "subl $hash, %eax" moved the hash immediate from offset 7 to offset 5 of the preamble. fineibt_preamble_hash was updated to match, but the open-coded offset in cfi_get_func_hash() was missed and it still reads the hash at offset 7. cfi_get_func_hash() is used by the BPF JIT to give a struct_ops trampoline the CFI hash of the stub function it stands in for. With FineIBT the trampoline now gets the upper half of the real hash followed by the first two bytes of the next instruction, so the first indirect call from the kernel into a struct_ops program, tcp_init_congestion_control() calling ->init() of a BPF congestion control for example, fails the FineIBT check and the kernel dies with a CFI failure. Move the FineIBT preamble template and its offset defines above cfi_get_func_hash() and use fineibt_preamble_hash there, so every reader of the preamble shares one definition of its layout. The CFI_FINEIBT arm is only built with CONFIG_FINEIBT, the only configuration in which cfi_mode can take that value. cfi_get_func_arity() does not need the same treatment: the __bhi_args call whose displacement it reads still ends at the function address.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: x86/cfi: Fix FineIBT hash offset in
    cfi_get_func_hash() The switch of the FineIBT preamble from "subl $hash, %r10d" to the shorter "subl
    $hash, %eax" moved the hash immediate from offset 7 to offset 5 of the preamble. fineibt_preamble_hash was
    updated to match, but the open-coded offset in cfi_get_func_hash() was missed and it still reads the hash
    at offset 7. cfi_get_func_hash() is used by the BPF JIT to give a struct_ops trampoline the CFI hash of
    the stub function it stands in for. With FineIBT the trampoline now gets the upper half of the real hash
    followed by the first two bytes of the next instruction, so the first indirect call from the kernel into a
    struct_ops program, tcp_init_congestion_control() calling ->init() of a BPF congestion control for
    example, fails the FineIBT check and the kernel dies with a CFI failure. Move the FineIBT preamble
    template and its offset defines above cfi_get_func_hash() and use fineibt_preamble_hash there, so every
    reader of the preamble shares one definition of its layout. The CFI_FINEIBT arm is only built with
    CONFIG_FINEIBT, the only configuration in which cfi_mode can take that value. cfi_get_func_arity() does
    not need the same treatment: the __bhi_args call whose displacement it reads still ends at the function
    address. (CVE-2026-97944)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: x86/cfi: Fix FineIBT hash offset in     cfi_get_func_hash() The switch of the FineIBT preamble from subl $hash, %r10d to the shorter subl     $hash, %eax moved the hash immediate from offset 7 to offset 5 of the preamble. fineibt_preamble_hash was     updated to match, but the open-coded offset in cfi_get_func_hash() was missed and it still reads the hash     at offset 7. cfi_get_func_hash() is used by the BPF JIT to give a struct_ops trampoline the CFI hash of     the stub function it stands in for. With FineIBT the trampoline now gets the upper half of the real hash     followed by the first two bytes of the next instruction, so the first indirect call from the kernel into a     struct_ops program, tcp_init_congestion_control() calling ->init() of a BPF congestion control for     example, fails the FineIBT check and the kernel dies with a CFI failure. Move the FineIBT preamble     template and its offset defines above cfi_get_func_hash() and use fineibt_preamble_hash there, so every     reader of the preamble shares one definition of its layout. The CFI_FINEIBT arm is only built with     CONFIG_FINEIBT, the only configuration in which cfi_mode can take that value. cfi_get_func_arity() does     not need the same treatment: the __bhi_args call whose displacement it reads still ends at the function     address. (CVE-2026-97944)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
376443	Ubuntu 24.04 LTS / 26.04 LTS : Linux kernel vulnerabilities (USN-8959-1)	Nessus	Ubuntu Local Security Checks	Local	high
475275	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106	Tenable Cloud Security	Google COS Security Checks	Local	medium
475275	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
350471	Linux Distros Unpatched Vulnerability : CVE-2026-97944	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-97944

high

Tenable Plugins

high

medium

medium

medium