Look up another CVE · open CVE-2026-90177 in the interactive tracker
CVE-2026-90177
bpf: Check pointer type for all atomic RMW paths
Published 2026-09-17 (31 days ago) by the Linux kernel CNA. Subsystem kernel/bpf. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-90177 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | vulnerable | 6.12.113-1 | No fix published anywhere yet, neither in Debian nor upstream for the series trixie tracks. Watch the Debian tracker page for this CVE. Advisories for trixie have historically landed a median of 11 days after publication. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Atomic RMW verification records an instruction pointer type only when the current destination is PTR_TO_ARENA. A second path can therefore reach the same instruction with an ordinary pointer without comparing it against the saved arena type. The post-verification fixup uses the saved type to rewrite the instruction to BPF_PROBE_ATOMIC for every path. Record the actual destination type for all atomic RMW paths so the existing mismatch check rejects incompatible uses of one instruction.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
kernel/bpf/verifier.c
- What this is
- BPF [CORE]MAINTAINERS section matched on kernel/bpf/verifier.c · bpf@vger.kernel.org · Maintained
Check it on the machine
grep -wE 'CONFIG_BPF|CONFIG_BPF_SYSCALL' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
- Build switches
- CONFIG_BPF, CONFIG_BPF_SYSCALL
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-17 (31 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 6.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- kernel/bpf
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.10 | 6.18.57 | d4ba9d888ac0 |
| 6.10 | 7.2.6 | eb287c6e81de |
| 6.10 | 7.3 | 4bc49ae344d6 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The attacker-controlled input is the BPF instruction stream copied in bpf_prog_load() from bpf(2) BPF_PROG_LOAD (__sys_bpf). do_check_insn() then check_atomic() then check_atomic_rmw() sees a mixed PTR_TO_ARENA versus kernel-pointer atomic; that bytecode is local syscall input, not a remote protocol payload.
- AC:LAttack complexity, low
- The attacker authors both verifier paths: one branch with a PTR_TO_ARENA destination and another with PTR_TO_MAP_VALUE or PTR_TO_STACK at the same BPF_ATOMIC RMW. check_atomic_rmw() records only the arena type, bpf_convert_ctx_accesses() rewrites it to BPF_PROBE_ATOMIC, and bpf_prog_test_run_syscall() takes the non-arena path on demand.
- PR:LPrivileges required, low
- The mixed path needs a BPF_MAP_TYPE_ARENA map; check_map_prog_compatibility() rejects that unless env->bpf_capable and env->allow_ptr_leaks (bpf_token_capable(CAP_BPF) and bpf_token_capable(CAP_PERFMON)). bpf_token_capable() uses ns_capable() on a delegated token userns, so this is not init-namespace root.
- UI:NUser interaction, none
- The attacker creates the arena with BPF_MAP_CREATE, loads the mixed-path program with BPF_PROG_LOAD, and executes it via bpf_prog_test_run() to bpf_prog_test_run_syscall(); no other user must mount, open a file, or otherwise cooperate.
- S:UScope, unchanged
- The confused BPF_PROBE_ATOMIC is JITed as emit_atomic_rmw_index() adding arena kern_vm_start (R12) onto a kernel map or stack pointer and runs in the host kernel; that is host memory corruption, not a KVM/Xen guest-to-host escape or IOMMU bypass.
- C:HConfidentiality impact, high
- After bpf_convert_ctx_accesses() rewrites the shared RMW to BPF_PROBE_ATOMIC, the non-arena path executes lock xchg/cmpxchg/fetch-add at (PTR_TO_MAP_VALUE or PTR_TO_STACK + bpf_arena_get_kern_vm_start()). BPF_FETCH, XCHG, and CMPXCHG return the old value from that address, an arbitrary kernel read.
- I:HIntegrity impact, high
- The same instruction performs an attacker-chosen atomic RMW (BPF_ADD/AND/OR/XOR/XCHG/CMPXCHG in check_atomic_rmw) at kernel_ptr+kern_vm_start. With CONFIG_VMAP_STACK or a vmalloc map, that sum is a canonical direct-map address, giving a kernel write primitive.
- A:HAvailability impact, high
- An atomic RMW into the direct map corrupts live kernel state and can panic; a non-canonical or unmapped sum that a JIT does not cover with an exception table oopses. Type-confused kernel atomics are Availability High.