CVE-2026-90217 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf: Compare iterator types during state pruning
An iterator stack slot can be MEM_RCU or PTR_UNTRUSTED. These states must not be equal, or the verifier can prune an unsafe path.
Compare the pointer type for STACK_ITER slots.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel's Berkeley Packet Filter (BPF) subsystem includes a sophisticated verifier designed to ensure that eBPF programs are safe and will not cause system instability or security breaches during execution. A critical aspect of this verification process is state pruning, which allows the verifier to recognize when two different paths through a program lead to equivalent states, thereby avoiding redundant analysis. However, a flaw was identified in how the verifier handles iterator stack slots within this pruning logic. Specifically, the vulnerability arises from an insufficient comparison of pointer types during the state equivalence check for STACK_ITER slots. The kernel's memory model distinguishes between various pointer attributes, including whether a pointer is protected by Read-Copy-Update (RCU) synchronization mechanisms or if it is untrusted data that has not been properly validated against potential security risks such as out-of-bounds access or use-after-free conditions.
The technical flaw lies in the fact that an iterator stack slot could be assigned either MEM_RCU, indicating a pointer protected by RCU read-side critical sections, or PTR_UNTRUSTED, which signifies data whose safety has not been verified by the verifier. Under normal circumstances, these two states represent fundamentally different security postures and should never be considered equivalent for pruning purposes. If the verifier incorrectly treats an untrusted pointer as equivalent to a trusted RCU-protected one, it may prune a code path that actually contains unsafe operations. This misclassification allows potentially dangerous instructions or memory accesses to bypass strict validation checks because the verifier assumes they have already been validated under safer conditions in another branch of the program logic.
This vulnerability falls squarely within CWE-20: Improper Input Validation and CWE-841: Improper Enforcement of Behavioral Workflow, as it involves a failure to correctly validate and enforce distinct security states during internal processing workflows. From an offensive perspective, this aligns with MITRE ATT&CK technique T1623: Use Alternate Authentication Path, where an attacker might exploit the logic flaw to bypass intended verification constraints. The operational impact of this vulnerability is significant because it can lead to privilege escalation or kernel crashes if a malicious eBPF program exploits the mispruned state to perform unauthorized memory accesses. An attacker crafting a specially designed BPF program could leverage this discrepancy to execute code that would otherwise be rejected, potentially gaining root-level access on the affected system or causing a denial of service through kernel panics resulting from invalid pointer dereferences.
Mitigation for this issue requires applying the specific patch released by the Linux kernel maintainers which enforces strict type comparison for STACK_ITER slots during state pruning. System administrators should ensure that their systems are updated with the latest stable kernel versions containing this fix. Additionally, organizations deploying eBPF programs in production environments should adhere to least-privilege principles and utilize existing security frameworks such as SELinux or AppArmor to restrict which users can load BPF programs. Regular auditing of loaded eBPF bytecode using tools like bpftool can help detect any anomalous behavior resulting from unpatched vulnerabilities, ensuring that only verified and safe programs are executed within the kernel space.