CVE-2026-90157

bpf: Reject negative optlen in cgroup getsockopt hook

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject negative optlen in cgroup getsockopt hook

A cgroup getsockopt BPF program can shrink ctx->optlen after the kernel getsockopt handler has run. The kernel-buffer variant, used by TCP_ZEROCOPY_RECEIVE, only rejects values larger than the original length.

If BPF writes a negative optlen, that value is accepted and propagated back to the TCP getsockopt code. It can then be passed to copy_to_sockptr() as a size_t and trigger the hardened usercopy bytes > INT_MAX warning.

Reject negative ctx.optlen in __cgroup_bpf_run_filter_getsockopt_kern(), matching the lower-bound validation already present in the sockptr-based getsockopt hook.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	08f61a34913558e06576e7b6318bf583f273c1be to before 5b09d984b38b018b123c3a9e02a96bbc6468dbe5Affected 9cacf81f8161111db25f98e78a7a0e32ae142b3f to before 554ba7195c4108726450e24480c8449990c2268cAffected 9cacf81f8161111db25f98e78a7a0e32ae142b3f to before d02a12b4085ffe41ea750b1007f7a9c7aee2875aAffected 9cacf81f8161111db25f98e78a7a0e32ae142b3f to before e6fbf0eba87f50084d67508898f6ad6fc7ff1ba2Affected 9cacf81f8161111db25f98e78a7a0e32ae142b3f to before f68671b1a98d426c57864bd457c125fee14ac1a5Affected 9cacf81f8161111db25f98e78a7a0e32ae142b3f to before 2bdbe00454200fcb0110f31eeca8d906a3515e74Affected 9cacf81f8161111db25f98e78a7a0e32ae142b3f to before 31a89af4f513d750fec196e2bb6195a7d4473e9fAffected 9cacf81f8161111db25f98e78a7a0e32ae142b3f to before 1b5aacd5b2419b0790e955e466d389a61c79b4b1Affected 5.10.188 to before 5.10.270Affected
LinuxLinux	5.12Affected before 5.12Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

08f61a34913558e06576e7b6318bf583f273c1be to before 5b09d984b38b018b123c3a9e02a96bbc6468dbe5Affected
9cacf81f8161111db25f98e78a7a0e32ae142b3f to before 554ba7195c4108726450e24480c8449990c2268cAffected
9cacf81f8161111db25f98e78a7a0e32ae142b3f to before d02a12b4085ffe41ea750b1007f7a9c7aee2875aAffected
9cacf81f8161111db25f98e78a7a0e32ae142b3f to before e6fbf0eba87f50084d67508898f6ad6fc7ff1ba2Affected
9cacf81f8161111db25f98e78a7a0e32ae142b3f to before f68671b1a98d426c57864bd457c125fee14ac1a5Affected
9cacf81f8161111db25f98e78a7a0e32ae142b3f to before 2bdbe00454200fcb0110f31eeca8d906a3515e74Affected
9cacf81f8161111db25f98e78a7a0e32ae142b3f to before 31a89af4f513d750fec196e2bb6195a7d4473e9fAffected
9cacf81f8161111db25f98e78a7a0e32ae142b3f to before 1b5aacd5b2419b0790e955e466d389a61c79b4b1Affected
5.10.188 to before 5.10.270Affected

LinuxLinux

5.12Affected
before 5.12Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.