CVE-2026-90195 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args
On RV64, the ABI requires sign-extension for signed 1-byte and 2-byte kfunc args. However, the RV64 JIT currently does not perform sign-extension for such kfunc args.
Before commit 7ce090afbf72 ("bpf: Infer zext_dst based on static register liveness analysis"), state pruning could potentially omit zero-extension of 32-bit subregisters, which inadvertently masked the above issue by making the args appear as if they had been properly sign-extended. After that commit, the problem is exposed, causing the kfunc_call/kfunc_call_test4 selftest to fail.
Fix this by extending the existing sign-extension logic to handle signed 1-byte and 2-byte kfunc args as well.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel's BPF Just-In-Time (JIT) compiler for RISC-V architectures contains a critical implementation flaw regarding argument passing conventions, specifically affecting signed one-byte and two-byte arguments passed to kernel functions. This vulnerability stems from a deviation between the expected Application Binary Interface behavior on RV64 systems and the actual code generation logic within the JIT compiler. According to the standard ABI requirements for 64-bit RISC-V processors, any signed integer argument smaller than the native word size must be sign-extended to fill the full register width before being passed to a function call. This ensures that negative values are correctly interpreted by the callee and prevents data corruption or logic errors resulting from improper interpretation of high-order bits. The existing implementation failed to perform this necessary sign-extension for these specific smaller-sized arguments, leaving them in an improperly formatted state within the registers used for argument passing.
The operational impact of this defect was previously obscured due to a coincidental interaction with another kernel subsystem feature related to register liveness analysis and state pruning. Prior to commit 7ce090afbf72, which introduced improvements based on static register liveness analysis, the BPF verifier's state pruning mechanism would inadvertently omit zero-extension operations for thirty-two-bit subregisters. This omission effectively masked the underlying sign-extension deficiency by forcing a behavior that aligned with correct expectations in many common scenarios. Consequently, vulnerabilities related to improper argument handling remained latent and undetected during standard testing phases. However, once the aforementioned commit was integrated into the kernel codebase, the masking effect disappeared. The change exposed the root cause of the issue, leading to immediate failures in self-test suites such as kfunc_call_test4, which validates the correct behavior of kernel function calls within BPF programs.
From a security perspective, this vulnerability falls under CWE-758: Reliance on Undefined, Unspecified, or Implementation-Specific Behavior, specifically relating to ABI compliance and data type handling errors. It can also be categorized under CWE-190: Integer Overflow or Wraparound if the lack of sign extension leads to unexpected arithmetic results when negative values are treated as large positive unsigned integers. In the context of the MITRE ATT&CK framework for enterprise security, this flaw relates to Tactic Execution and Technique Command-and-Control implications where BPF programs might be used for monitoring or enforcement; however, more directly it aligns with exploitation techniques involving improper input validation and type confusion that could potentially lead to privilege escalation if a maliciously crafted eBPF program exploits the misinterpreted arguments to bypass security checks or access unauthorized kernel memory regions. The failure to correctly extend signed values creates a predictable discrepancy between user-space expectations and kernel-space execution, which sophisticated attackers could leverage in targeted attacks against systems relying on complex BPF-based network filtering or observability tools.
To mitigate this vulnerability, it is imperative that the RISC-V JIT compiler logic be updated to explicitly handle sign-extension for all signed integer arguments of one-byte and two-byte sizes before they are placed into registers for function calls. This fix ensures strict adherence to the RV64 ABI specifications regardless of subsequent optimizations in register liveness analysis or state pruning algorithms. System administrators should apply kernel updates that include this patch immediately, particularly on systems running recent versions where the masking effect has been removed and self-tests may be failing. For organizations utilizing BPF for security monitoring or network policy enforcement, verifying the integrity of these function calls is crucial to maintaining the reliability of their defense mechanisms against advanced persistent threats that might exploit kernel-level inconsistencies.