CVE-2026-90177

HighCVSS 7.8/10Last modified Oct 21, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Check pointer type for all atomic RMW paths

Atomic RMW verification records an instruction pointer type only when the current destination is PTR_TO_ARENA. A second path can therefore reach the same instruction with an ordinary pointer without comparing it against the saved arena type.

The post-verification fixup uses the saved type to rewrite the instruction to BPF_PROBE_ATOMIC for every path. Record the actual destination type for all atomic RMW paths so the existing mismatch check rejects incompatible uses of one instruction.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= d503a04f8bc0c75dc9db9452d8cc79d748afb752, < b14dabe9656c1029abf3aa01e69c0d62f37f2f88; >= d503a04f8bc0c75dc9db9452d8cc79d748afb752, < d4ba9d888ac0a8f12c78071fff73e1205a0b9293; >= d503a04f8bc0c75dc9db9452d8cc79d748afb752, < eb287c6e81dedef92da01eb947f380d0aae513c3; >= d503a04f8bc0c75dc9db9452d8cc79d748afb752, < 4bc49ae344d65cfcef738f281ac575cf73ca2fc5
LinuxLinux6.10

References

Timeline

Published
Sep 17, 2026
Last modified
Oct 21, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-90178In the Linux kernel, the following vulnerability has been resolved: hwmon: (coretemp) Fix core_data leak on CPUs without PTS pdata->core_dCVE-2026-90179In the Linux kernel, the following vulnerability has been resolved: apparmor: fix deadlock in complain-mode change_hat The use of change_hCVE-2026-90188.8The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to Privilege Escalation in all versions up tCVE-2026-90180In the Linux kernel, the following vulnerability has been resolved: block: mtip32xx: synchronize ioctls with device removal The ioctl handCVE-2026-90181In the Linux kernel, the following vulnerability has been resolved: ublk: avoid teardown retry loop on xarray allocation failure __ublk_shCVE-2026-90182In the Linux kernel, the following vulnerability has been resolved: blk-iocost: clear delay state when freeing policy data iocg_kick_delayCVE-2026-90183In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: clear delay state when freeing policy data io.latency cCVE-2026-90184In the Linux kernel, the following vulnerability has been resolved: null_blk: serialize configfs attribute updates with device setup The aCVE-2026-90185In the Linux kernel, the following vulnerability has been resolved: null_blk: serialize configfs attribute stores with the lock The NULLB_CVE-2026-90186In the Linux kernel, the following vulnerability has been resolved: null_blk: reject per-device queue resize for shared tag set When shareCVE-2026-90187In the Linux kernel, the following vulnerability has been resolved: null_blk: free zones array on device power-off null_init_zoned_dev() aCVE-2026-90188In the Linux kernel, the following vulnerability has been resolved: null_blk: free global tag_set on init error path If shared_tags is ena