HIGH
bpf CgroupOptLen OOB
CVE-2026-90157
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative optlen in cgroup getsockopt hook A cgroup getsockopt BPF program can shrink ctx->optlen after the kernel getsockopt handler has run. The kernel-buffer variant, used by TCP_ZEROCOPY_RECEIVE, only rejects values larger than the original length. If BPF writes a negative optlen, that value is accepted and propagated back to the TCP getsockopt code. It can then be passed to copy_to_sockptr() as a size_t and trigger the hardened usercopy bytes > INT_MAX warning. Reject negative ctx.optlen in __cgroup_bpf_run_filter_getsockopt_kern(), matching the lower-bound validation already present in the sockptr-based getsockopt hook.
02KernelScan AI Analysis
Risk summary
A cgroup BPF getsockopt program can set a negative output length that the kernel-buffer code path fails to reject. The value is reinterpreted as a very large unsigned size, triggering a hardened usercopy warning that can panic the kernel and potentially cause out-of-bounds memory access. Any local process with CAP_BPF can trigger this.
Vulnerability analysis
A cgroup BPF program attached to the getsockopt hook can set the output buffer length to a negative value. The kernel-buffer variant of this hook, used for TCP zero-copy receive, only rejects lengths larger than the original buffer size but does not check for negative values. When a negative length is propagated back to the TCP getsockopt code, it is reinterpreted as a very large unsigned value, triggering a hardened usercopy warning and potentially causing an out-of-bounds memory access. The fix adds a lower-bound check to reject negative lengths, matching the validation already present in the other getsockopt hook variant. This is reachable locally by any process that can load and attach cgroup BPF programs, which requires the BPF capability.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 5.10.188 | 5.10.270 | 5b09d984b38b |
| 6.1 | — | 6.1.188 | d02a12b4085f |
| 6.18 | — | 6.18.52 | 2bdbe0045420 |
| mainline | — | 7.3-rc1 | 1b5aacd5b241 |
| 5.15 | — | 5.15.221 | 554ba7195c41 |
| 6.6 | — | 6.6.157 | e6fbf0eba87f |
| 6.12 | — | 6.12.110 | f68671b1a98d |
| 7.2 | — | 7.2.6 | 31a89af4f513 |
| cip/6.12 | — | 6.12.111-cip32 | f68671b1a98d |