CVE-2026-90177 (GCVE-0-2026-90177)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:07 – Updated: 2026-09-18 17:53
VLAI
Title
bpf: Check pointer type for all atomic RMW paths
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Check pointer type for all atomic RMW paths Atomic RMW verification records an instruction pointer type only when the current destination is PTR_TO_ARENA. A second path can therefore reach the same instruction with an ordinary pointer without comparing it against the saved arena type. The post-verification fixup uses the saved type to rewrite the instruction to BPF_PROBE_ATOMIC for every path. Record the actual destination type for all atomic RMW paths so the existing mismatch check rejects incompatible uses of one instruction.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d503a04f8bc0c75dc9db9452d8cc79d748afb752 , < eb287c6e81dedef92da01eb947f380d0aae513c3 (git)
Affected: d503a04f8bc0c75dc9db9452d8cc79d748afb752 , < 4bc49ae344d65cfcef738f281ac575cf73ca2fc5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "eb287c6e81dedef92da01eb947f380d0aae513c3",
              "status": "affected",
              "version": "d503a04f8bc0c75dc9db9452d8cc79d748afb752",
              "versionType": "git"
            },
            {
              "lessThan": "4bc49ae344d65cfcef738f281ac575cf73ca2fc5",
              "status": "affected",
              "version": "d503a04f8bc0c75dc9db9452d8cc79d748afb752",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check pointer type for all atomic RMW paths\n\nAtomic RMW verification records an instruction pointer type only when the\ncurrent destination is PTR_TO_ARENA. A second path can therefore reach the\nsame instruction with an ordinary pointer without comparing it against the\nsaved arena type.\n\nThe post-verification fixup uses the saved type to rewrite the instruction\nto BPF_PROBE_ATOMIC for every path. Record the actual destination type for\nall atomic RMW paths so the existing mismatch check rejects incompatible\nuses of one instruction."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker-controlled input is the BPF instruction stream copied in bpf_prog_load() from bpf(2) BPF_PROG_LOAD (__sys_bpf). do_check_insn() then check_atomic() then check_atomic_rmw() sees a mixed PTR_TO_ARENA versus kernel-pointer atomic; that bytecode is local syscall input, not a remote protocol payload.\nAC:L - The attacker authors both verifier paths: one branch with a PTR_TO_ARENA destination and another with PTR_TO_MAP_VALUE or PTR_TO_STACK at the same BPF_ATOMIC RMW. check_atomic_rmw() records only the arena type, bpf_convert_ctx_accesses() rewrites it to BPF_PROBE_ATOMIC, and bpf_prog_test_run_syscall() takes the non-arena path on demand.\nPR:L - The mixed path needs a BPF_MAP_TYPE_ARENA map; check_map_prog_compatibility() rejects that unless env-\u003ebpf_capable and env-\u003eallow_ptr_leaks (bpf_token_capable(CAP_BPF) and bpf_token_capable(CAP_PERFMON)). bpf_token_capable() uses ns_capable() on a delegated token userns, so this is not init-namespace root.\nUI:N - The attacker creates the arena with BPF_MAP_CREATE, loads the mixed-path program with BPF_PROG_LOAD, and executes it via bpf_prog_test_run() to bpf_prog_test_run_syscall(); no other user must mount, open a file, or otherwise cooperate.\nS:U - The confused BPF_PROBE_ATOMIC is JITed as emit_atomic_rmw_index() adding arena kern_vm_start (R12) onto a kernel map or stack pointer and runs in the host kernel; that is host memory corruption, not a KVM/Xen guest-to-host escape or IOMMU bypass.\nC:H - After bpf_convert_ctx_accesses() rewrites the shared RMW to BPF_PROBE_ATOMIC, the non-arena path executes lock xchg/cmpxchg/fetch-add at (PTR_TO_MAP_VALUE or PTR_TO_STACK + bpf_arena_get_kern_vm_start()). BPF_FETCH, XCHG, and CMPXCHG return the old value from that address, an arbitrary kernel read.\nI:H - The same instruction performs an attacker-chosen atomic RMW (BPF_ADD/AND/OR/XOR/XCHG/CMPXCHG in check_atomic_rmw) at kernel_ptr+kern_vm_start. With CONFIG_VMAP_STACK or a vmalloc map, that sum is a canonical direct-map address, giving a kernel write primitive.\nA:H - An atomic RMW into the direct map corrupts live kernel state and can panic; a non-canonical or unmapped sum that a JIT does not cover with an exception table oopses. Type-confused kernel atomics are Availability High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:53:37.480Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/eb287c6e81dedef92da01eb947f380d0aae513c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/4bc49ae344d65cfcef738f281ac575cf73ca2fc5"
        }
      ],
      "title": "bpf: Check pointer type for all atomic RMW paths",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90177",
    "datePublished": "2026-09-17T16:07:03.097Z",
    "dateReserved": "2026-09-11T19:38:34.791Z",
    "dateUpdated": "2026-09-18T17:53:37.480Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90177",
      "date": "2026-09-25",
      "epss": "0.00165",
      "percentile": "0.05085"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/bpf/verifier.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "eb287c6e81dedef92da01eb947f380d0aae513c3",
                    "status": "affected",
                    "version": "d503a04f8bc0c75dc9db9452d8cc79d748afb752",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4bc49ae344d65cfcef738f281ac575cf73ca2fc5",
                    "status": "affected",
                    "version": "d503a04f8bc0c75dc9db9452d8cc79d748afb752",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "kernel/bpf/verifier.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.10"
                  },
                  {
                    "lessThan": "6.10",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check pointer type for all atomic RMW paths\n\nAtomic RMW verification records an instruction pointer type only when the\ncurrent destination is PTR_TO_ARENA. A second path can therefore reach the\nsame instruction with an ordinary pointer without comparing it against the\nsaved arena type.\n\nThe post-verification fixup uses the saved type to rewrite the instruction\nto BPF_PROBE_ATOMIC for every path. Record the actual destination type for\nall atomic RMW paths so the existing mismatch check rejects incompatible\nuses of one instruction."
          }
        ],
        "id": "CVE-2026-90177",
        "lastModified": "2026-09-18T18:17:45.693",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:11.623",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4bc49ae344d65cfcef738f281ac575cf73ca2fc5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/eb287c6e81dedef92da01eb947f380d0aae513c3"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-21T16:31:32Z",
      "cve": "CVE-2026-90177",
      "id": "CVE-2026-90177",
      "initial_release_date": "2026-09-21T16:31:32Z",
      "product_status:known_affected": "29",
      "product_status:known_not_affected": "318",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-90177",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-90177.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.