CVE-2026-90358bpf, x86: Fix trampoline stack size for 128-bit arguments
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix trampoline stack size for 128-bit arguments btf_distill_func_proto() accepts a function argument up to 16 bytes, so a 128-bit scalar such as __int128 reaches the x86 trampoline with arg_size == 16. But the current implementation assumes an __int128 argument only needs one register, so the register save area is under-allocated and save_args() overwrites adjacent stack slots. Compute the register count from arg_size for all arguments to fix it.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 18, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from a9c5ad31fbdc4dec6d266fe22e51de1ad6d1bcf2 before 4aed2346fa9b88d458eeb8c01123f3c07585a675; from a9c5ad31fbdc4dec6d266fe22e51de1ad6d1bcf2 before 40f3bfbbb222b92278f3797614b70f68d46824ac; from a9c5ad31fbdc4dec6d266fe22e51de1ad6d1bcf2 before a6d7d7a253c550e74b0651897fe313c2f9b2301f; from a9c5ad31fbdc4dec6d266fe22e51de1ad6d1bcf2 before 814cba835ef648e0c5eb79505c96c0493b29eea6 | CNA record |
References
- https://git.kernel.org/stable/c/4aed2346fa9b88d458eeb8c01123f3c07585a675
- https://git.kernel.org/stable/c/40f3bfbbb222b92278f3797614b70f68d46824ac
- https://git.kernel.org/stable/c/a6d7d7a253c550e74b0651897fe313c2f9b2301f
- https://git.kernel.org/stable/c/814cba835ef648e0c5eb79505c96c0493b29eea6
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.