CVE-2026-90211: bpf, s390: Clear fetch destination on faulting arena atomic
In the Linux kernel, the following vulnerability has been resolved:
bpf, s390: Clear fetch destination on faulting arena atomic
Same missing register clear as on riscv64. A RMW atomic on an arena pointer is converted to BPFPROBEATOMIC and gets an exception table entry, but bpfjitprobeatomicpre() only fills in the arena base and the probe offset, leaving probe->reg at the -1 that bpfjitprobeinit() set, which bpfjitprobepost() writes into the entry and exhandlerbpf() then reads back as "there is nothing to clear".
That is right for a plain BPF{ADD,AND,OR,XOR}, which only writes memory, but an RMW carrying BPFFETCH also reads the old value into a register: srcreg for BPF{ADD,AND,OR,XOR} | BPFFETCH and BPFXCHG, and r0 for BPFCMPXCHG. So on a fault over an unmapped arena page the program resumes at the landing pad with whatever that register held before the atomic instead of the 0 that every other BPFPROBE access delivers.
Fill probe->reg in from bpfatomicloadreg(). Unlike x86-64 and arm64, s390x does not report arena violations from its exception handler, so there is no access direction to correct here, only the missing register clear.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue is specific to the Linux kernel BPF JIT on s390x. It requires a BPF program to perform a read-modify-write atomic operation with a fetched result against an arena pointer that faults on an unmapped arena page.
What is the effect of a fault during an affected atomic operation?
After the fault, the BPF program can resume with the destination register retaining its pre-atomic value rather than being cleared to zero. The affected destination is the source register for fetched ADD, AND, OR, or XOR operations and XCHG, or r0 for CMPXCHG.