HIGH Introduced in 6.10
bpf AtomicRmw Bypass
CVE-2026-90177
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI8.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Check pointer type for all atomic RMW paths Atomic RMW verification records an instruction pointer type only when the current destination is PTR_TO_ARENA. A second path can therefore reach the same instruction with an ordinary pointer without comparing it against the saved arena type. The post-verification fixup uses the saved type to rewrite the instruction to BPF_PROBE_ATOMIC for every path. Record the actual destination type for all atomic RMW paths so the existing mismatch check rejects incompatible uses of one instruction.
02KernelScan AI Analysis
Risk summary
A BPF verifier bypass allows a crafted program to use atomic read-modify-write instructions with mismatched pointer types, leading to type confusion and arbitrary kernel memory corruption. Any local process with BPF loading privileges (CAP_BPF, or unprivileged BPF if enabled) can trigger this. Successful exploitation can escalate privileges or crash the kernel.
Vulnerability analysis
The kernel's BPF program verifier fails to consistently track pointer types for atomic read-modify-write instructions across all program paths. A malicious program can reach the same atomic instruction through one path with an arena pointer and through another path with an ordinary pointer, but the verifier only records the type from the first path. Code that prepares the program for execution after verification then applies the arena assumption to every path, creating a type confusion that can corrupt kernel memory. The fix ensures the verifier records the true pointer type on every path that reaches an atomic operation, so programs that mix incompatible pointer types are rejected. This can be triggered locally by any process that is able to load BPF programs, which requires CAP_BPF on most systems unless unprivileged BPF loading has been explicitly enabled.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| mainline | 6.10 | 7.3-rc1 | 4bc49ae344d6 |
| 7.2 | 6.10 | 7.2.6 | eb287c6e81de |