Cloudanix VulnDB

CVE-2026-92520

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel bug could let certain low-level programs accidentally read leftover data from memory, which might reveal information that should have stayed private.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw allows BPF queue and stack pop/peek helpers to return without initializing the caller-supplied output buffer when a lock acquisition fails with -EBUSY, exposing uninitialized kernel stack contents to the BPF program.

Why it matters to the business

On Linux systems using BPF maps, this can result in limited leakage of kernel memory contents to unprivileged or sandboxed BPF programs, increasing the risk of sensitive data exposure in containerized or multi-tenant environments despite low observed exploitation rates.

How an attack unfolds

An attacker loads a BPF program that repeatedly invokes queue or stack pop/peek helpers under artificial contention to trigger lock-acquisition failures, then reads residual stack data from the uninitialized output buffer to harvest kernel memory artifacts.

How to fix it

Upgrade the Linux kernel to a version containing the fix that zeros the output buffer before returning -EBUSY from the affected queue and stack helpers.

How to confirm the fix worked

Confirm the kernel source contains the patch that clears the output buffer prior to the -EBUSY return path in the queue/stack helper implementations and test that BPF programs no longer observe uninitialized data after lock failures.

Typical attack path

  1. Load a custom BPF program that targets queue or stack map helpers
  2. Create contention on the target map to force lock-acquisition failures
  3. Invoke pop/peek operations and read the uninitialized output buffer
  4. Extract and analyze any leaked kernel stack contents for sensitive data

How to detect it

Examine kernel logs and audit records for unusual BPF program loads involving queue or stack maps; look for repeated map operation failures under load that might indicate attempted exploitation.

What your security team should do

  • Prioritize kernel updates on systems that heavily rely on BPF map operations
  • Review and restrict untrusted BPF program loading where feasible
  • Monitor upstream kernel changelogs for related BPF stability fixes

The record

In the Linux kernel, the following vulnerability has been resolved: bpf: Zero queue and stack outputs on lock failure Queue and stack pop/peek helpers accept an uninitialized output buffer because the verifier expects the helper to initialize it. The empty-map error path clears the buffer, but a failed lock acquisition returns -EBUSY without writing it. Clear the output before returning -EBUSY so BPF programs cannot observe uninitialized stack contents after a failed helper call.

Affected packages

Ecosystem Package Introduced Fixed