Executive brief
The Linux kernel's BPF (Berkeley Packet Filter) subsystem contains a validation weakness in how it checks atomic read-modify-write operations. A crafted BPF program could bypass security checks by using multiple code paths to reach the same instruction with different pointer types, potentially allowing unauthorized memory access or privilege escalation on systems that load untrusted BPF programs.
Technical details
The vulnerability is a logic error in kernel/bpf/verifier.c within the check_atomic_rmw function. The verifier only recorded the destination pointer type when it was PTR_TO_ARENA, allowing a second execution path to reach the same instruction with an ordinary pointer without type validation. The post-verification fixup then applied BPF_PROBE_ATOMIC rewriting based on the saved type for all paths, creating a mismatch. The fix ensures the actual destination type is recorded for all atomic RMW paths, enabling the existing mismatch check to reject incompatible pointer type usages. This affects the BPF subsystem's ability to safely verify untrusted eBPF programs; exploitation requires the ability to load BPF programs, typically restricted to privileged users or specific container/kernel capabilities.
Affected products
- Linux Linux kernel 5.12 and later (affected by d503a04f8bc0, fixed in 2026-08-16)
Timeline
- 2026-09-17: disclosed: CVE-2026-90177 published
- 2026-08-16: patched: Fix committed upstream