CVE-2026-90300bpf: Clear buf on error in __bpf_get_task_stack
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: bpf: Clear buf on error in __bpf_get_task_stack Both bpf_get_task_stack and bpf_get_task_stack_sleepable helpers that use __bpf_get_task_stack have buf defined as ARG_PTR_TO_UNINIT_MEM argument and we should initialize the buf on every return path. Adding missing buf memset for __bpf_get_task_stack fail paths. This provides deterministic buffer contents, which is useful when the buffer is used directly as a map key.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 06ab134ce8ecfa5a69e850f88f81c8a4c3fa91df builds before 1f0f61573ba4cb899105b5cef65be3ca02205f93; from 06ab134ce8ecfa5a69e850f88f81c8a4c3fa91df before f523359c4789bb0396d2d642464a6e2fd4f2299d; from 06ab134ce8ecfa5a69e850f88f81c8a4c3fa91df before f5d242825ca417bb6afe35fde6e8880f97ca43fb; d921baabd96445ef9c9c9410ca06164359c8a1a5; 9c020a533eaae1c2d41a7e3835c4c818a9b4b656; ff6bdc205fd0a83bd365405d4e31fb5905826996; from 5.10.30 before 5.11; from 5.11.14 before 5.12; and 1 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/1f0f61573ba4cb899105b5cef65be3ca02205f93
- https://git.kernel.org/stable/c/f523359c4789bb0396d2d642464a6e2fd4f2299d
- https://git.kernel.org/stable/c/f5d242825ca417bb6afe35fde6e8880f97ca43fb
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.