CVE-2026-90300

What it actually does

On error paths in __bpf_get_task_stack the ARG_PTR_TO_UNINIT_MEM buffer is not cleared, leaving it with indeterminate kernel-stack contents that can later be used directly as a BPF map key.

Why it matters to the business

Unpatched kernels expose residual kernel memory through BPF map operations, creating a low-probability information-leak vector that may affect compliance or allow limited data exposure in container or observability workloads.

How an attack unfolds

An attacker loads a BPF program that forces an error return from bpf_get_task_stack or bpf_get_task_stack_sleepable, then inserts the untouched buffer into a map; subsequent map lookups or key comparisons can reveal prior stack contents.

How to fix it

Apply the upstream commit that adds explicit memset on every error return from __bpf_get_task_stack; rebuild and deploy the updated kernel image or distribution package.

How to confirm the fix worked

Inspect the patched __bpf_get_task_stack function to confirm memset calls exist on all error paths; run BPF selftests that exercise the error paths and verify the buffer contains only zeros.

Typical attack path

1. Load a BPF program that invokes bpf_get_task_stack and triggers an error path
2. Pass the uninitialized buffer as a map key without clearing it
3. Observe map behavior or iterate keys to recover residual kernel memory

How to detect it

Search kernel or audit logs for BPF program loads that call bpf_get_task_stack followed by map-update operations; correlate with any anomalous map-key patterns that contain non-zero residual data.

What your security team should do

• Prioritize kernel updates containing the memset fix for all systems that permit unprivileged BPF
• Restrict CAP_BPF or unprivileged BPF where not required
• Monitor EPSS and KEV status for any future rise in exploit maturity