CVE-2026-90358: bpf, x86: Fix trampoline stack size for 128-bit arguments
In the Linux kernel, the following vulnerability has been resolved:
bpf, x86: Fix trampoline stack size for 128-bit arguments
btfdistillfuncproto() accepts a function argument up to 16 bytes, so a 128-bit scalar such as int128 reaches the x86 trampoline with argsize == 16. But the current implementation assumes an int128 argument only needs one register, so the register save area is under-allocated and saveargs() overwrites adjacent stack slots.
Compute the register count from argsize for all arguments to fix it.
Affected Software
Event History
Frequently Asked Questions
Which systems are in scope?
The issue affects the Linux kernel on x86 in the BPF trampoline path. It is relevant where a trampoline handles a function argument represented as a 128-bit scalar, such as __int128.
What condition causes the stack corruption?
The corruption occurs when a 16-byte function argument reaches the x86 trampoline but is treated as requiring only one register. The resulting undersized register-save area allows save_args() to overwrite adjacent stack slots.