CVE-2026-92520

bpf: Zero queue and stack outputs on lock failure

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 30, 2026
Reserved: Sep 16, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Zero queue and stack outputs on lock failure

Queue and stack pop/peek helpers accept an uninitialized output buffer because the verifier expects the helper to initialize it. The empty-map error path clears the buffer, but a failed lock acquisition returns -EBUSY without writing it.

Clear the output before returning -EBUSY so BPF programs cannot observe uninitialized stack contents after a failed helper call.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e388671635acf470f0986d874389148fd234620b to before 6468e8ac026b44ae2a78114b80f9d1b9164d0f6cAffected a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 to before a6090eeb289c5fa45f7b629befac2bd3c19a6daeAffected a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 to before 23b4bcc79bab5285275912b94e98c286f281de75Affected a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 to before 1534c4bff3aaca19c4c9a82f93e9b81f7c983de3Affected a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 to before e2396b8a562073787e627a5f483f1bc5c452fa6aAffected a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 to before 7ac6e1ae41a09f1dd4baeeff1d028ae49ee01232Affected 40e34ea01748e5b8afdd40a172868be1e1ab0edeAffected 388c9d3eefaea99828ee5000c693128a5b41ee7cAffected acabf5df49aa3a4f9c96200102d893351b511a88Affected 232f0ba4d69263af5912e279fcc32fef2882b1dcAffected 6.1.56 to before 6.1.191Affected 5.4.258 to before 5.5Affected 5.10.198 to before 5.11Affected 5.15.134 to before 5.16Affected 6.5.6 to before 6.6Affected
LinuxLinux	6.6Affected before 6.6Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

e388671635acf470f0986d874389148fd234620b to before 6468e8ac026b44ae2a78114b80f9d1b9164d0f6cAffected
a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 to before a6090eeb289c5fa45f7b629befac2bd3c19a6daeAffected
a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 to before 23b4bcc79bab5285275912b94e98c286f281de75Affected
a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 to before 1534c4bff3aaca19c4c9a82f93e9b81f7c983de3Affected
a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 to before e2396b8a562073787e627a5f483f1bc5c452fa6aAffected
a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 to before 7ac6e1ae41a09f1dd4baeeff1d028ae49ee01232Affected
40e34ea01748e5b8afdd40a172868be1e1ab0edeAffected
388c9d3eefaea99828ee5000c693128a5b41ee7cAffected
acabf5df49aa3a4f9c96200102d893351b511a88Affected
232f0ba4d69263af5912e279fcc32fef2882b1dcAffected
6.1.56 to before 6.1.191Affected
5.4.258 to before 5.5Affected
5.10.198 to before 5.11Affected
5.15.134 to before 5.16Affected
6.5.6 to before 6.6Affected

LinuxLinux

6.6Affected
before 6.6Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.