CVE-2026-90177bpf: Check pointer type for all atomic RMW paths
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: bpf: Check pointer type for all atomic RMW paths Atomic RMW verification records an instruction pointer type only when the current destination is PTR_TO_ARENA. A second path can therefore reach the same instruction with an ordinary pointer without comparing it against the saved arena type. The post-verification fixup uses the saved type to rewrite the instruction to BPF_PROBE_ATOMIC for every path. Record the actual destination type for all atomic RMW paths so the existing mismatch check rejects incompatible uses of one instruction.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from d503a04f8bc0c75dc9db9452d8cc79d748afb752 before d4ba9d888ac0a8f12c78071fff73e1205a0b9293; from d503a04f8bc0c75dc9db9452d8cc79d748afb752 before eb287c6e81dedef92da01eb947f380d0aae513c3; from d503a04f8bc0c75dc9db9452d8cc79d748afb752 before 4bc49ae344d65cfcef738f281ac575cf73ca2fc5 | CNA record |
References
- https://git.kernel.org/stable/c/d4ba9d888ac0a8f12c78071fff73e1205a0b9293
- https://git.kernel.org/stable/c/eb287c6e81dedef92da01eb947f380d0aae513c3
- https://git.kernel.org/stable/c/4bc49ae344d65cfcef738f281ac575cf73ca2fc5
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.