CVE-2026-90358

What it actually does

Under-allocation of the x86 BPF trampoline register save area for 128-bit arguments causes save_args() to overwrite adjacent stack slots, resulting in a kernel stack buffer overflow.

Why it matters to the business

Attackers with the ability to load crafted BPF programs can crash the kernel or execute arbitrary code with kernel privileges, leading to full system compromise, data theft, or denial of service on affected Linux systems.

How an attack unfolds

An attacker crafts a BPF program containing a function prototype with a 128-bit argument, loads it into the kernel, and triggers the trampoline generation path; the undersized stack allocation then allows the overflow to corrupt adjacent memory, enabling control-flow hijacking or information disclosure.

How to fix it

Update the Linux kernel to a version containing the fix that computes the correct register count from arg_size for all arguments when allocating the trampoline register save area.

How to confirm the fix worked

Verify the kernel source contains the corrected register-count calculation based on arg_size, rebuild, and confirm no 128-bit argument causes stack-slot overwrites via targeted BPF loading tests.

Typical attack path

1. Obtain local access or a container with sufficient capabilities to load BPF programs
2. Prepare a BPF program whose function prototype uses a 128-bit scalar argument
3. Load the program via bpf() syscall to trigger btf_distill_func_proto and trampoline creation
4. Trigger execution of the trampoline to cause the stack overwrite
5. Leverage the resulting memory corruption for privilege escalation or kernel code execution

How to detect it

Review kernel logs for oops or stack-protector violations mentioning bpf or trampoline functions; inspect audit logs for bpf() syscalls from unexpected processes; correlate with any recent BPF program loads.

What your security team should do

• Prioritize kernel updates on systems that permit untrusted BPF program loading
• Restrict BPF loading to trusted processes via capabilities and LSM policies
• Monitor for unusual BPF program loads and kernel oops or crashes involving trampolines