CVE-2026-90300 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf: Clear buf on error in __bpf_get_task_stack
Both bpf_get_task_stack and bpf_get_task_stack_sleepable helpers that use __bpf_get_task_stack have buf defined as ARG_PTR_TO_UNINIT_MEM argument and we should initialize the buf on every return path.
Adding missing buf memset for __bpf_get_task_stack fail paths. This provides deterministic buffer contents, which is useful when the buffer is used directly as a map key.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel's eBPF subsystem contains a critical information disclosure vulnerability within the internal helper function __bpf_get_task_stack and its associated wrappers bpf_get_task_stack and bpf_get_task_stack_sleepable. This flaw stems from improper handling of uninitialized memory buffers when error conditions occur during stack trace retrieval operations. The affected functions define their output buffer as an ARG_PTR_TO_UNINIT_MEM argument, which implies that the caller expects to receive data but does not guarantee initialization by the kernel prior to invocation. Under normal execution paths where the operation succeeds, the buffer is populated with valid task stack information. However, when internal checks fail or resources are unavailable, the code path returns early without clearing or initializing the buffer contents.
This lack of initialization results in deterministic yet unintended exposure of previously used memory regions that remain within the kernel's address space. When a BPF program invokes these helpers and encounters an error condition, such as insufficient permissions or invalid task references, the returned buffer retains whatever data was last written to that specific memory location by previous operations. This constitutes an out-of-bounds read vulnerability in the context of information leakage, allowing potentially sensitive kernel memory contents to be passed back to user-space BPF programs. The severity is amplified because eBPF programs can directly utilize these buffers as keys for map lookups or other data structures, effectively creating a channel through which arbitrary kernel heap or stack content can be exfiltrated based on allocation patterns and prior usage history.
From an industry standards perspective, this vulnerability aligns with CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, specifically falling under the category of information leakage via uninitialized memory variables. It also relates to CWE-457: Use of Uninitialized Variable within a specific context where failure paths do not enforce state consistency. In terms of adversarial tactics, this flaw could be leveraged in conjunction with ATT&CK technique T1083: File and Directory Discovery or more accurately T1005: Data from Local System for initial reconnaissance and lateral movement preparation by an attacker who has achieved code execution via a vulnerable eBPF program. The ability to read arbitrary kernel memory significantly lowers the barrier for privilege escalation attacks that rely on gathering system state information before exploiting subsequent vulnerabilities such as use-after-free or type confusion flaws.
The operational impact of this vulnerability is substantial, particularly in environments where untrusted users are permitted to load and execute BPF programs. An attacker with access to create eBPF maps and invoke these helpers can systematically probe kernel memory regions by triggering error conditions repeatedly across different buffer allocations. Over time, patterns emerge that allow the reconstruction of sensitive data structures, cryptographic keys, or authentication tokens residing in those memory locations. This undermines the security boundary between unprivileged user-space applications and privileged kernel components, potentially leading to full system compromise if combined with other exploitation techniques.
Mitigation strategies primarily involve applying vendor-provided kernel patches that address this specific issue by ensuring all return paths within __bpf_get_task_stack explicitly initialize or clear the buffer before returning control to the caller. For systems where immediate patching is not feasible, restricting access to BPF map creation and eBPF program loading through strict LSM policies such as AppArmor or SELinux can reduce the attack surface. Additionally, enabling kernel hardening features like CONFIG_BPF_UNPRIV_DEFAULT_OFF ensures that unprivileged users cannot load arbitrary BPF programs by default, thereby preventing exploitation of this vulnerability until a permanent fix is deployed. Regular auditing of eBPF program permissions and monitoring for unusual memory access patterns in security information and event management systems can also aid in detecting potential exploitation attempts.