CVE-2026-90358 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf, x86: Fix trampoline stack size for 128-bit arguments
btf_distill_func_proto() accepts a function argument up to 16 bytes, so a 128-bit scalar such as __int128 reaches the x86 trampoline with arg_size == 16. But the current implementation assumes an __int128 argument only needs one register, so the register save area is under-allocated and save_args() overwrites adjacent stack slots.
Compute the register count from arg_size for all arguments to fix it.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel's eBPF subsystem relies on a complex mechanism involving trampolines to bridge user-space programs with kernel functions, particularly when passing data between them via BTF-defined function prototypes. A critical vulnerability was identified in the x86 implementation of this trampoline logic, specifically concerning how stack space is allocated for large arguments. The issue stems from an inconsistency in size calculation within the btf_distill_func_proto() routine and its downstream usage during register state management. When a function prototype includes a 128-bit argument, such as __int128, the system correctly identifies that this data type requires sixteen bytes of storage space to be passed effectively. However, the existing implementation incorrectly assumes that any single logical argument corresponds to exactly one general-purpose register for saving purposes during the trampoline execution context.
This architectural oversight leads to a severe stack buffer overflow condition within the kernel's memory management layer. Because the code calculates the required register save area based on the number of arguments rather than their cumulative byte size, it allocates insufficient space when 128-bit types are involved. Consequently, when the save_args() function executes to preserve CPU registers before invoking the target BPF program or helper, it writes beyond the boundaries of the allocated stack frame. This out-of-bounds write operation corrupts adjacent memory locations on the kernel stack, potentially overwriting critical control data such as return addresses, saved base pointers, or other register states belonging to the calling context.
The operational impact of this vulnerability is significant due to its potential for privilege escalation and system instability. An attacker who can trigger a BPF program that utilizes 128-bit arguments in conjunction with x86 architecture-specific trampoline logic could exploit this stack corruption. By carefully crafting input data, it may be possible to overwrite the return address or other control flow indicators on the kernel stack. This allows for arbitrary code execution within the kernel space, effectively granting an unprivileged user full root privileges. Furthermore, even without successful exploitation of memory corruption for code execution, the random overwriting of adjacent stack slots can lead to immediate system crashes, resulting in a denial-of-service condition that affects all users on the affected system.
This flaw is categorized under CWE-121, which denotes a stack-based buffer overflow vulnerability arising from improper size calculation and boundary checking during memory allocation operations. In terms of attack vector classification within the MITRE ATT&CK framework, this issue facilitates techniques associated with privilege escalation through local exploitation of kernel vulnerabilities. The attacker typically needs to have access to create or load eBPF programs, which may require specific capabilities depending on system configuration, but once achieved, the impact is severe due to the direct manipulation of kernel memory structures.
Mitigation strategies primarily involve applying the upstream Linux kernel patches that correct the register count computation logic. Developers must ensure that the calculation for the number of registers required in the save area is derived directly from the total argument size rather than a simplistic one-register-per-argument heuristic. For system administrators unable to immediately patch, restricting unprivileged users from loading eBPF programs via BPF_PROG_LOAD syscalls can reduce exposure until updates are deployed. Additionally, enabling kernel hardening features such as stack protector randomization and enforcing strict memory access controls through SELinux or AppArmor policies may provide secondary layers of defense against exploitation attempts stemming from this specific buffer overflow condition.