Executive brief
The Linux kernel's BPF (Berkeley Packet Filter) subsystem contains a function that retrieves task stack information for monitoring and debugging purposes. When this function encounters an error, it previously returned uninitialized memory to the caller, which could leak sensitive kernel data or be exploited if the buffer is used as a cryptographic key or map identifier.
Technical details
The vulnerability is an information disclosure issue in the kernel/bpf/stackmap.c file, specifically in the __bpf_get_task_stack() function. The function accepts a buffer parameter defined as ARG_PTR_TO_UNINIT_MEM (uninitialized memory), which should be initialized on all code paths before return. Two error paths failed to clear the buffer via memset(): when try_get_task_stack() fails and when task_pt_regs() returns NULL. This allowed uninitialized kernel memory to be returned to BPF helpers bpf_get_task_stack and bpf_get_task_stack_sleepable. An unprivileged BPF program (on systems allowing unprivileged BPF) can read kernel memory by calling these helpers and observing the uninitialized buffer contents. The fix adds memset(buf, 0, size) calls to both error paths, ensuring deterministic buffer state.
Affected products
- Linux Linux kernel affected versions through CVE-2026-90300; fixed in commit f5d242825ca417bb6afe35fde6e8880f97ca43fb and backported to multiple stable branches
Timeline
- 2026-08-03: other: Fix commit authored by Jiri Olsa
- 2026-08-05: patched: Fix committed upstream
- 2026-09-17: disclosed: CVE-2026-90300 published
- 2026-09-14: other: Fix backported to stable branches