CVE-2026-90143

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The missing rcu_read_lock is in kcm_parse_func_strparser(), reached after local socket(AF_KCM) and ioctl(SIOCKCMATTACH) installing the caller's BPF_PROG_TYPE_SOCKET_FILTER via bpf_prog_get_type(). A remote TCP peer can only feed an skb into strp_recv(); map helpers fire regardless of payload, and the BPF program is locally supplied.

AC:LAttack complexity, low

kcm_attach() always calls strp_check_rcv(), which queues do_strp_work so parse_msg runs in process context under lock_sock() with BH enabled, so bpf_rcu_lock_held() is false. The attacker loads a SOCKET_FILTER that calls bpf_map_lookup_elem and can delete the same HASH key from their own map fd on another thread.

PR:LPrivileges required, low

kcm_create() and kcm_ioctl(SIOCKCMATTACH) have no capable() check, and PF_KCM autoloads via MODULE_ALIAS_NETPROTO. bpf_prog_get_type(..., BPF_PROG_TYPE_SOCKET_FILTER) and HASH/ARRAY maps are the unprivileged types in bpf_prog_load()/map_create(); CAP_BPF in the init namespace is not required when unprivileged BPF is enabled.

UI:NUser interaction, none

The attacker opens their own AF_KCM and TCP sockets, loads their own SOCKET_FILTER, issues SIOCKCMATTACH, and either pre-queues TCP data so strp_check_rcv() runs the parser or writes the TCP peer themselves. No other user must mount a filesystem, open a device, or attach a program.

S:UScope, unchanged

A dangling htab_elem used by kcm_parse_func_strparser() is a host-kernel use-after-free that can escalate privileges inside the same kernel. It does not cross a KVM/Xen guest-host boundary or an IOMMU/DMA domain.

C:HConfidentiality impact, high

bpf_map_lookup_elem() proceeds after WARN_ON_ONCE(!bpf_rcu_lock_held()) and __htab_map_lookup_elem() still returns a pointer. Concurrent htab delete via the attacker's map fd frees or freelist-reuses that htab_elem (bpf_mem_cache_free/pcpu_freelist_push) while the SOCKET_FILTER still reads the map value, disclosing kernel heap.

I:HIntegrity impact, high

The verifier treats the map-value pointer as writable, so the SOCKET_FILTER can store through the dangling htab_elem after free_htab_elem() reuses it, and bpf_map_update_elem() also runs without RCU from kcm_parse_func_strparser(). That is an arbitrary kernel write via heap reuse, not a bounded overwrite.

A:HAvailability impact, high

Use of the dangling htab_elem in do_strp_work oopses or panics the kernel. Independently, bpf_map_lookup_elem()/__htab_map_lookup_elem() hit WARN_ON_ONCE(!bpf_rcu_lock_held()) on the first map helper from kcm_parse_func_strparser(), which is fatal on kernels booted with panic_on_warn.