CVE-2026-90250

bpf, cgroup: Fix storage null-ptr-deref after replacing prog

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf, cgroup: Fix storage null-ptr-deref after replacing prog

Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog B uses BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE and calls the bpf_get_local_storage helper. 3. link_update is called to replace prog A with prog B.

The reason is that __cgroup_bpf_replace fails to alloc and assign the required cgrp storage for the incoming replacement prog. Consequently, the new prog inherits an uninit storage, leading to null-ptr-deref panic when kick the new prog.

Fix this by rejecting a link update if new_prog's cgroup storage is incompatible with link->prog.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	0c991ebc8c69d29b7fc44db17075c5aa5253e2ab to before 85785e7e2ebddcaa5c3b31bd3bcd83ae648985d4Affected 0c991ebc8c69d29b7fc44db17075c5aa5253e2ab to before 16c8321ee40c420f8e02e09515a5126682ddf4eaAffected 0c991ebc8c69d29b7fc44db17075c5aa5253e2ab to before a033c950f6731be88a7da98604ed78f302f15b80Affected 0c991ebc8c69d29b7fc44db17075c5aa5253e2ab to before 1ab3da12061d7ccb099f7e925fa2d865967a316aAffected 0c991ebc8c69d29b7fc44db17075c5aa5253e2ab to before 12feca126831556dc7fabe5a3ba28fbd328768b6Affected 0c991ebc8c69d29b7fc44db17075c5aa5253e2ab to before 3f562c537e9ecf4bc5e206cfffc2cc047f1b7e94Affected
LinuxLinux	5.7Affected before 5.7Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

0c991ebc8c69d29b7fc44db17075c5aa5253e2ab to before 85785e7e2ebddcaa5c3b31bd3bcd83ae648985d4Affected
0c991ebc8c69d29b7fc44db17075c5aa5253e2ab to before 16c8321ee40c420f8e02e09515a5126682ddf4eaAffected
0c991ebc8c69d29b7fc44db17075c5aa5253e2ab to before a033c950f6731be88a7da98604ed78f302f15b80Affected
0c991ebc8c69d29b7fc44db17075c5aa5253e2ab to before 1ab3da12061d7ccb099f7e925fa2d865967a316aAffected
0c991ebc8c69d29b7fc44db17075c5aa5253e2ab to before 12feca126831556dc7fabe5a3ba28fbd328768b6Affected
0c991ebc8c69d29b7fc44db17075c5aa5253e2ab to before 3f562c537e9ecf4bc5e206cfffc2cc047f1b7e94Affected

LinuxLinux

5.7Affected
before 5.7Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.