143 lines
8.2 KiB
JSON
143 lines
8.2 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-90269",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-09-11T19:38:34.796Z",
|
|
"datePublished": "2026-09-17T16:08:03.996Z",
|
|
"dateUpdated": "2026-10-19T09:00:46.990Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-19T09:00:46.990Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject load-acquire from pointers requiring fault protection\n\nA BPF_LOAD_ACQ is not rewritten to a BPF_PROBE_MEM load by the verifier,\nunlike a regular BPF_LDX, so the JIT emits a plain load with no exception\ntable entry and a fault panics the kernel instead of being handled.\n\nReject the source pointer types that a BPF_LDX would have had that fault\nprotection applied to, i.e. the ones bpf_convert_ctx_accesses() turns\ninto BPF_PROBE_MEM: a bare PTR_TO_BTF_ID, PTR_TO_BTF_ID | PTR_UNTRUSTED,\nPTR_TO_BTF_ID | MEM_ALLOC | PTR_UNTRUSTED and PTR_TO_MEM | MEM_RDONLY |\nPTR_UNTRUSTED.\n\nThis is reachable e.g. by loading ->mm out of a trusted task_struct\nyields an untrusted pointer to mm_struct, and it is NULL for a kernel\nthread:\n\n [...]\n SEC(\"tp_btf/sched_switch\")\n int BPF_PROG(demo, bool preempt, struct task_struct *prev,\n struct task_struct *next)\n {\n struct mm_struct *mm = next->mm; /* untrusted */\n\n out_ldx = (__u64)mm->pgd; /* BPF_LDX */\n out_acq = load_acquire(&mm->pgd); /* BPF_LOAD_ACQ */\n return 0;\n }\n [...]\n\nBoth dereference the same pointer, but only the BPF_LDX is protected\n(x86-64 JIT, jump targets shown prog-relative):\n\n [...]\n ; out_ldx = (__u64)mm->pgd;\n 17: movq $-10485760, %r10\n 1e: movq %rsi, %r11\n 21: addq $184, %r11\n 28: subq %r10, %r11\n 2b: movabsq $140737498841088, %r10\n 35: cmpq %r10, %r11\n 38: ja 0x3e <-- kernel addr?\n 3a: xorl %edi, %edi <-- no: dst = 0, skip the load\n 3c: jmp 0x45\n 3e: movq 184(%rsi), %rdi <-- yes: load + extable entry\n [...]\n ; load_acquire(&mm->pgd)\n 53:\tmovq %rsi, %rdi\n 56:\tmovq 184(%rdi), %rax <-- no check, no extable entry\n [...]\n\nNote that BPF_PROBE_MEM is not visible in a bpftool xlated dump, as\nbpf_insn_prepare_dump() rewrites it back to BPF_MEM.\n\nA PTR_TRUSTED pointer is deliberately not on the list. Such a load is\nnot converted either, but it does not need to be, since the pointer is\nguaranteed live, so load-acquire from it stays allowed.\n\nThe check is gated on BPF_LOAD_ACQ so that atomic RMW and store-release\nerror messages are unchanged; writes (RMW / store-release) to such\npointers are already rejected elsewhere, so only load-acquire needs this."
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"kernel/bpf/verifier.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "880442305a3908589bf4d6fc1d79edb577ee497c",
|
|
"lessThan": "c4c8de3bf48d3756ab0f910fe5cc4937d70efdcd",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "880442305a3908589bf4d6fc1d79edb577ee497c",
|
|
"lessThan": "5f8ade6e9b7931fc9697394f1b2c4ae833f5ac18",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "880442305a3908589bf4d6fc1d79edb577ee497c",
|
|
"lessThan": "7db0a00445f1a40bacfe9b747405c11cb5f10fc9",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"kernel/bpf/verifier.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.15",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.15",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.52",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2.6",
|
|
"lessThanOrEqual": "7.2.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.3",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.15",
|
|
"versionEndExcluding": "6.18.52"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.15",
|
|
"versionEndExcluding": "7.2.6"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.15",
|
|
"versionEndExcluding": "7.3"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/c4c8de3bf48d3756ab0f910fe5cc4937d70efdcd"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/5f8ade6e9b7931fc9697394f1b2c4ae833f5ac18"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/7db0a00445f1a40bacfe9b747405c11cb5f10fc9"
|
|
}
|
|
],
|
|
"title": "bpf: Reject load-acquire from pointers requiring fault protection",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |