Executive brief
A vulnerability exists in the Linux kernel's Berkeley Packet Filter (BPF) socket option handler where a malicious or buggy BPF program can write a negative value to the option length parameter. This negative value can propagate to kernel copy operations and trigger hardened security warnings or potential memory safety issues. The fix validates that the option length is never negative, preventing misuse by BPF programs.
Technical details
This is an input validation vulnerability in the cgroup BPF getsockopt hook (specifically __cgroup_bpf_run_filter_getsockopt_kern()). A BPF program can manipulate ctx->optlen to a negative value after the kernel getsockopt handler executes; this negative value is then propagated to copy_to_sockptr() where it is interpreted as a large positive size_t, triggering the hardened usercopy check (bytes > INT_MAX warning). The fix adds a validation check to reject any ctx.optlen < 0, matching existing validation in the sockptr-based getsockopt path. Attack precondition is the ability to load and execute a BPF program in a cgroup context. A patch was committed to mainline and backported to stable kernel series.
Affected products
- Linux Linux kernel multiple versions prior to commit 1b5aacd5b2419b0790e955e466d389a61c79b4b1
Timeline
- 2026-09-17: disclosed: CVE-2026-90157 published
- 2026-08-17: patched: Fix committed to mainline (commit 1b5aacd5b2419b0790e955e466d389a61c79b4b1)