UBUNTU-CVE-2026-90211: Medium severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: bpf, s390: Clear fetch destination on faulting arena atomic Same missing register clear as on riscv64. A RMW atomic on an arena pointer is converted to BPFPROBEATOMIC and gets an exception table entry, but bpfjitprobeatomicpre() only fills in the arena base and the probe offset, leaving probe->reg at the -1 that bpfjitprobeinit() set, which bpfjitprobepost() writes into the entry and exhandlerbpf() then reads back as "there is nothing to clear". That is right for a plain BPF{ADD,AND,OR,XOR}, which only writes memory, but an RMW carrying BPFFETCH also reads the old value into a register: srcreg for BPF{ADD,AND,OR,XOR} | BPFFETCH and BPFXCHG, and r0 for BPFCMPXCHG. So on a fault over an unmapped arena page the program resumes at the landing pad with whatever that register held before the atomic instead of the 0 that every other BPFPROBE access delivers. Fill probe->reg in from bpfatomicloadreg(). Unlike x86-64 and arm64, s390x does not report arena violations from its exception handler, so there is no access direction to correct here, only the missing register clear.