CVE-2026-90300: bpf: Clear buf on error in __bpf_get_task_stack
In the Linux kernel, the following vulnerability has been resolved:
bpf: Clear buf on error in bpfgettaskstack
Both bpfgettaskstack and bpfgettaskstacksleepable helpers that use bpfgettaskstack have buf defined as ARGPTRTOUNINITMEM argument and we should initialize the buf on every return path.
Adding missing buf memset for bpfgettaskstack fail paths. This provides deterministic buffer contents, which is useful when the buffer is used directly as a map key.
Event History
Frequently Asked Questions
Which BPF helpers are involved?
The affected paths are bpf_get_task_stack and bpf_get_task_stack_sleepable, both of which use __bpf_get_task_stack.
When can the caller receive non-deterministic buffer contents?
This occurs on failure paths in __bpf_get_task_stack when the output buffer is not cleared before returning an error. It is particularly relevant when the buffer is used directly as a map key.
What does the fix change?
The fix adds buffer clearing on __bpf_get_task_stack failure paths, ensuring deterministic contents for the buffer on every return path.