Executive brief
The Linux kernel's eBPF (extended Berkeley Packet Filter) subsystem, which is used for in-kernel virtual machine execution of untrusted programs, contains a logic error in fault handling for atomic operations on s390x processors. When an atomic memory operation with fetch capability faults on an unmapped arena page, the destination register is not properly cleared, potentially exposing stale data instead of the expected zero value to the running program.
Technical details
The vulnerability exists in the s390x eBPF JIT compiler's handling of BPF_PROBE_ATOMIC operations on arena pointers. When a read-modify-write (RMW) atomic instruction carrying the BPF_FETCH flag faults on an unmapped arena page, the exception handler should clear the destination register (src_reg for ADD/AND/OR/XOR with FETCH, or r0 for CMPXCHG) to zero, consistent with other BPF_PROBE_* accesses. However, bpf_jit_probe_atomic_pre() fails to populate the probe->reg field, leaving it at -1, which signals the exception handler that no register clearing is needed. This causes the program to resume with whatever value was previously in that register instead of zero. The fix involves initializing probe->reg from bpf_atomic_load_reg() to ensure proper register clearing on fault.
Affected products
- Linux Linux kernel Multiple versions (linux-5.0 through linux-7.1 and stable branches) with BPF arena atomic support
Timeline
- 2026-09-17: disclosed: CVE-2026-90211 published
- 2026-08-11: patched: Upstream commit cc3e12330599f097f0e1f792435686ddc276f26d merged
- 2026-09-14: patched: Stable tree backport commit 44b702fceb4cf3a4ddbfb496f487b034814bf1a3