CVE-2026-90157: bpf: Reject negative optlen in cgroup getsockopt hook
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject negative optlen in cgroup getsockopt hook
A cgroup getsockopt BPF program can shrink ctx->optlen after the kernel getsockopt handler has run. The kernel-buffer variant, used by TCPZEROCOPYRECEIVE, only rejects values larger than the original length.
If BPF writes a negative optlen, that value is accepted and propagated back to the TCP getsockopt code. It can then be passed to copytosockptr() as a sizet and trigger the hardened usercopy bytes > INTMAX warning.
Reject negative ctx.optlen in cgroupbpfrunfiltergetsockoptkern(), matching the lower-bound validation already present in the sockptr-based getsockopt hook.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the kernel so that __cgroup_bpf_run_filter_getsockopt_kern() rejects negative ctx.optlen values (do not accept/propagate negative optlen written by the BPF program).
Linux kernel (cgroup getsockopt BPF hook) Reject negative ctx.optlen in __cgroup_bpf_run_filter_getsockopt_kern() = enabled - Configuration
Ensure the TCP_ZEROCOPY_RECEIVE getsockopt code rejects negative ctx.optlen (not just values larger than the original length/INT_MAX), so the negative size cannot be passed back to the kernel getsockopt handler via copy_to_sockptr().
Linux kernel (TCP zerocopy receive getsockopt path) Reject negative optlen propagation = enabled - Configuration
Prevent negative optlen from being converted to size_t in copy_to_sockptr() and reaching hardened usercopy, by rejecting negative optlen earlier in the cgroup getsockopt hook.
Linux kernel (copy_to_sockptr()/usercopy hardening) Hardened usercopy trigger prevention = enabled
Event History
Frequently Asked Questions
What conditions are required for this issue to be triggered?
A cgroup getsockopt BPF program must modify ctx->optlen to a negative value after the kernel getsockopt handler runs. The affected kernel-buffer getsockopt path is used by TCP_ZEROCOPY_RECEIVE.
What behavior indicates that a system may be affected?
An affected system can propagate a negative optlen into TCP getsockopt processing, where it is converted to size_t for copy_to_sockptr(). This can trigger a hardened usercopy warning for a byte count greater than INT_MAX.
What does the available fix change?
The fix rejects negative ctx.optlen values in __cgroup_bpf_run_filter_getsockopt_kern(). This aligns that path with the lower-bound validation already used by the sockptr-based getsockopt hook.