CVE-2026-90217: bpf: Compare iterator types during state pruning
In the Linux kernel, the following vulnerability has been resolved:
bpf: Compare iterator types during state pruning
An iterator stack slot can be MEMRCU or PTRUNTRUSTED. These states must not be equal, or the verifier can prune an unsafe path.
Compare the pointer type for STACKITER slots.
Affected Software
Event History
Frequently Asked Questions
What capability would an attacker need to reach the vulnerable verifier behavior?
The issue is in BPF verifier state pruning and involves iterator stack slots. Exploitation would require reaching verifier analysis of a BPF program using iterator stack slots with MEM_RCU and PTR_UNTRUSTED states.
What condition causes the unsafe path to be pruned?
During state pruning, iterator stack slots with MEM_RCU and PTR_UNTRUSTED states can be treated as equal. This can cause the verifier to prune a path that should remain distinct and be checked.
What is the remediation?
Apply a Linux kernel update that includes the fix to compare pointer types for STACK_ITER slots during verifier state pruning. The provided stable kernel references identify commits containing the resolution.