UBUNTU-CVE-2026-90250: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix storage null-ptr-deref after replacing prog Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog B uses BPFMAPTYPEPERCPUCGROUPSTORAGE and calls the bpfgetlocalstorage helper. 3. linkupdate is called to replace prog A with prog B. The reason is that cgroupbpfreplace fails to alloc and assign the required cgrp storage for the incoming replacement prog. Consequently, the new prog inherits an uninit storage, leading to null-ptr-deref panic when kick the new prog. Fix this by rejecting a link update if newprog's cgroup storage is incompatible with link->prog.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Reject a link update when the incoming program's cgroup storage is incompatible with the existing link's program.
Event History
Frequently Asked Questions
Who can trigger this issue?
An attacker needs local access with the privileges required to attach and update cgroup BPF programs. The provided vector specifies low privileges and local attack access.
What conditions are required to cause the panic?
A cgroup must first have an empty program attached, then a replacement program that uses BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE and bpf_get_local_storage must be installed through link_update. The replacement inherits uninitialized storage, and executing the new program can cause a null-pointer-dereference panic.
What is the practical impact?
The reported outcome is a kernel panic, making this primarily an availability risk. The supplied impact vector indicates no confidentiality or integrity impact.
How does the fix prevent the issue?
The fix rejects a link update when the incoming program's cgroup storage is incompatible with the program currently associated with the link. This prevents the replacement program from running with uninitialized cgroup storage.