CVE-2026-90177: bpf: Check pointer type for all atomic RMW paths
In the Linux kernel, the following vulnerability has been resolved:
bpf: Check pointer type for all atomic RMW paths
Atomic RMW verification records an instruction pointer type only when the current destination is PTRTOARENA. A second path can therefore reach the same instruction with an ordinary pointer without comparing it against the saved arena type.
The post-verification fixup uses the saved type to rewrite the instruction to BPFPROBEATOMIC for every path. Record the actual destination type for all atomic RMW paths so the existing mismatch check rejects incompatible uses of one instruction.
Event History
Frequently Asked Questions
What BPF program pattern is relevant to this issue?
The issue involves an atomic read-modify-write instruction that can be reached through multiple paths, with one path using a PTR_TO_ARENA destination and another using an ordinary pointer. The verifier previously saved the destination type only for the arena path and did not detect the incompatible use on the other path.
What is the effect of the fix?
The fix records the actual destination pointer type for every atomic RMW path. This allows the existing type-mismatch check to reject programs that use the same instruction with incompatible pointer types, preventing fixup from rewriting all paths based on a saved arena type.