CVE-2026-92520: bpf: Zero queue and stack outputs on lock failure
In the Linux kernel, the following vulnerability has been resolved:
bpf: Zero queue and stack outputs on lock failure
Queue and stack pop/peek helpers accept an uninitialized output buffer because the verifier expects the helper to initialize it. The empty-map error path clears the buffer, but a failed lock acquisition returns -EBUSY without writing it.
Clear the output before returning -EBUSY so BPF programs cannot observe uninitialized stack contents after a failed helper call.
Affected Software
Event History
Frequently Asked Questions
Which BPF programs are exposed to this issue?
BPF programs that use queue or stack pop/peek helpers are exposed when a helper call fails to acquire its lock. The affected path returns -EBUSY without initializing the helper's output buffer.
What must happen for uninitialized data to be observable?
A queue or stack pop/peek helper must encounter a failed lock acquisition. In that case, the BPF program can observe uninitialized stack contents through the output buffer after the helper returns -EBUSY.
Does an empty queue or stack trigger the same behavior?
No. The empty-map error path already clears the output buffer; the issue is specific to the failed lock-acquisition path.