Executive brief
The Linux kernel's BPF (Berkeley Packet Filter) verifier incorrectly validates iterator state during code path optimization, allowing an attacker with BPF program loading capabilities to bypass security checks and potentially read restricted memory or escalate privileges on the system.
Technical details
This is a logic error in the BPF verifier's state pruning mechanism, which optimizes verification by reusing previously verified code paths. The vulnerability exists in the stacksafe() function in kernel/bpf/states.c. When comparing iterator stack slots with different memory types (MEM_RCU vs PTR_UNTRUSTED), the verifier failed to compare the pointer type field, allowing unsafe paths to be incorrectly pruned as equivalent. An attacker can load a specially crafted BPF program that exploits this mismatch to bypass RCU (Read-Copy-Update) safety checks or use untrusted pointers, leading to memory access violations. The fix adds an explicit type comparison (old_reg->type != cur_reg->type) before comparing iterator-specific fields. This requires BPF program loading privileges, typically restricted to privileged users or trusted contexts.
Affected products
- Linux Linux kernel Multiple versions (the fix was backported across many stable branches from 2.6.11.y through 7.2.y)
Timeline
- 2026-09-17: disclosed: CVE-2026-90217 published
- 2026-08-11: patched: Upstream fix commit 83608e303b95d07afba1c15da0b5d9e513c2f15a merged
- 2026-09-14: other: Fix backported to stable kernels