Executive brief
The Linux kernel's Berkeley Packet Filter (BPF) subsystem can crash when replacing an active cgroup program with a new one that uses different storage requirements. An attacker with permissions to attach or update BPF programs to cgroups can trigger a kernel panic, causing a denial of service to the affected system and potentially disrupting container or resource control operations.
Technical details
A null pointer dereference vulnerability exists in the BPF cgroup link update mechanism (kernel/bpf/cgroup.c). When __cgroup_bpf_replace() updates a cgroup program, it fails to validate that the new program's cgroup storage requirements match the old program's requirements. If prog A (empty storage) is replaced with prog B (using BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE), the new program inherits uninitialized storage, triggering a crash when the program calls bpf_get_local_storage(). The fix adds a compatibility check rejecting link updates where cgroup storage types differ between old and new programs. This requires CAP_SYS_ADMIN or similar BPF attachment permissions to exploit.
Affected products
- Linux Linux kernel before 6.14 (or patched versions in stable branches)
Timeline
- 2026-09-17: disclosed: CVE-2026-90250 published
- 2026-09-14: patched: Fix included in stable kernel branches as of 2026-09-14