CVE-2026-90358

bpf, x86: Fix trampoline stack size for 128-bit arguments

State: Published
Severity: 7.8 High
Published: Sep 17, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf, x86: Fix trampoline stack size for 128-bit arguments

btf_distill_func_proto() accepts a function argument up to 16 bytes, so a 128-bit scalar such as __int128 reaches the x86 trampoline with arg_size == 16. But the current implementation assumes an __int128 argument only needs one register, so the register save area is under-allocated and save_args() overwrites adjacent stack slots.

Compute the register count from arg_size for all arguments to fix it.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	a9c5ad31fbdc4dec6d266fe22e51de1ad6d1bcf2 to before 2189232984b45ac8281c80484ab9f67b380a2ca1Affected a9c5ad31fbdc4dec6d266fe22e51de1ad6d1bcf2 to before 7f96bf0d24b2acc0732906b60a10f06783f2470dAffected a9c5ad31fbdc4dec6d266fe22e51de1ad6d1bcf2 to before 4aed2346fa9b88d458eeb8c01123f3c07585a675Affected a9c5ad31fbdc4dec6d266fe22e51de1ad6d1bcf2 to before 40f3bfbbb222b92278f3797614b70f68d46824acAffected a9c5ad31fbdc4dec6d266fe22e51de1ad6d1bcf2 to before a6d7d7a253c550e74b0651897fe313c2f9b2301fAffected a9c5ad31fbdc4dec6d266fe22e51de1ad6d1bcf2 to before 814cba835ef648e0c5eb79505c96c0493b29eea6Affected
LinuxLinux	6.1Affected before 6.1Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

a9c5ad31fbdc4dec6d266fe22e51de1ad6d1bcf2 to before 2189232984b45ac8281c80484ab9f67b380a2ca1Affected
a9c5ad31fbdc4dec6d266fe22e51de1ad6d1bcf2 to before 7f96bf0d24b2acc0732906b60a10f06783f2470dAffected
a9c5ad31fbdc4dec6d266fe22e51de1ad6d1bcf2 to before 4aed2346fa9b88d458eeb8c01123f3c07585a675Affected
a9c5ad31fbdc4dec6d266fe22e51de1ad6d1bcf2 to before 40f3bfbbb222b92278f3797614b70f68d46824acAffected
a9c5ad31fbdc4dec6d266fe22e51de1ad6d1bcf2 to before a6d7d7a253c550e74b0651897fe313c2f9b2301fAffected
a9c5ad31fbdc4dec6d266fe22e51de1ad6d1bcf2 to before 814cba835ef648e0c5eb79505c96c0493b29eea6Affected

LinuxLinux

6.1Affected
before 6.1Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.