CVE-2026-90177

bpf: Check pointer type for all atomic RMW paths

State: Published
Severity: 7.8 High
Published: Sep 17, 2026
Updated: Oct 21, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Check pointer type for all atomic RMW paths

Atomic RMW verification records an instruction pointer type only when the current destination is PTR_TO_ARENA. A second path can therefore reach the same instruction with an ordinary pointer without comparing it against the saved arena type.

The post-verification fixup uses the saved type to rewrite the instruction to BPF_PROBE_ATOMIC for every path. Record the actual destination type for all atomic RMW paths so the existing mismatch check rejects incompatible uses of one instruction.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	d503a04f8bc0c75dc9db9452d8cc79d748afb752 to before b14dabe9656c1029abf3aa01e69c0d62f37f2f88Affected d503a04f8bc0c75dc9db9452d8cc79d748afb752 to before d4ba9d888ac0a8f12c78071fff73e1205a0b9293Affected d503a04f8bc0c75dc9db9452d8cc79d748afb752 to before eb287c6e81dedef92da01eb947f380d0aae513c3Affected d503a04f8bc0c75dc9db9452d8cc79d748afb752 to before 4bc49ae344d65cfcef738f281ac575cf73ca2fc5Affected
LinuxLinux	6.10Affected before 6.10Not affected 6.12.114 through 6.12.Not affected 6.18.57 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.