UBUNTU-CVE-2026-90358: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix trampoline stack size for 128-bit arguments btfdistillfuncproto() accepts a function argument up to 16 bytes, so a 128-bit scalar such as int128 reaches the x86 trampoline with argsize == 16. But the current implementation assumes an int128 argument only needs one register, so the register save area is under-allocated and saveargs() overwrites adjacent stack slots. Compute the register count from argsize for all arguments to fix it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the Linux kernel bpf x86 trampoline implementation, compute the register count from each argument's arg_size for all arguments, including 128-bit (__int128) arguments, so the register save area is correctly sized and save_args() does not overwrite adjacent stack slots.
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
An attacker needs local access and low privileges. Exploitation involves reaching an x86 BPF trampoline with a function argument up to 16 bytes, such as a 128-bit scalar, which causes the trampoline's register save area to be under-allocated.
Which Ubuntu kernel package families are identified as affected?
The listed affected package families are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, ubuntu/linux-hwe-edge, and ubuntu/linux-gkeop.
What is the impact if the vulnerability is exploited?
The under-allocated register save area lets save_args() overwrite adjacent stack slots. The reported severity vector rates confidentiality, integrity, and availability impact as high.