CVE-2026-90250bpf, cgroup: Fix storage null-ptr-deref after replacing prog
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix storage null-ptr-deref after replacing prog Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog B uses BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE and calls the bpf_get_local_storage helper. 3. link_update is called to replace prog A with prog B. The reason is that __cgroup_bpf_replace fails to alloc and assign the required cgrp storage for the incoming replacement prog. Consequently, the new prog inherits an uninit storage, leading to null-ptr-deref panic when kick the new prog. Fix this by rejecting a link update if new_prog's cgroup storage is incompatible with link->prog.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 0c991ebc8c69d29b7fc44db17075c5aa5253e2ab before a033c950f6731be88a7da98604ed78f302f15b80; from 0c991ebc8c69d29b7fc44db17075c5aa5253e2ab before 1ab3da12061d7ccb099f7e925fa2d865967a316a; from 0c991ebc8c69d29b7fc44db17075c5aa5253e2ab before 12feca126831556dc7fabe5a3ba28fbd328768b6; from 0c991ebc8c69d29b7fc44db17075c5aa5253e2ab before 3f562c537e9ecf4bc5e206cfffc2cc047f1b7e94 | CNA record |
References
- https://git.kernel.org/stable/c/a033c950f6731be88a7da98604ed78f302f15b80
- https://git.kernel.org/stable/c/1ab3da12061d7ccb099f7e925fa2d865967a316a
- https://git.kernel.org/stable/c/12feca126831556dc7fabe5a3ba28fbd328768b6
- https://git.kernel.org/stable/c/3f562c537e9ecf4bc5e206cfffc2cc047f1b7e94
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.