CVE-2026-90159: bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks
In the Linux kernel, the following vulnerability has been resolved:
bpf: Disallow bpf{g,s}etsockopt() in cgroup UNIX getname hooks
bpfsetsockopt() and bpfgetsockopt() call sockownedbyme() for full sockets, so these helpers expect the socket lock to be held.
BPFCGROUPUNIXGETPEERNAME and BPFCGROUPUNIXGETSOCKNAME run BPF programs without acquiring the socket lock. A program attached to either hook can therefore trigger the sockownedbyme() warning by calling bpfsetsockopt() or bpfgetsockopt().
Disallow bpfsetsockopt() and bpfgetsockopt() for CGROUPUNIXGETPEERNAME and CGROUPUNIXGETSOCKNAME.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Disallow bpf_setsockopt() and bpf_getsockopt() for the BPF_CGROUP_UNIX_GETPEERNAME and BPF_CGROUP_UNIX_GETSOCKNAME hooks.
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
A BPF program must be attached to either the CGROUP_UNIX_GETPEERNAME or CGROUP_UNIX_GETSOCKNAME hook and call bpf_setsockopt() or bpf_getsockopt(). Those hooks run without acquiring the socket lock expected by the helpers.
What is the observed impact when the issue is triggered?
The program can trigger the sock_owned_by_me() warning when either helper is called from one of the affected hooks.
What can be done before applying the resolved kernel change?
Do not use bpf_setsockopt() or bpf_getsockopt() in BPF programs attached to the affected CGROUP_UNIX_GETPEERNAME and CGROUP_UNIX_GETSOCKNAME hooks. The resolved change disallows those helper calls for these hooks.