HIGH Introduced in 5.5
bpf Trampoline RetVal Corruption
CVE-2026-90359
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
01Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject >8 byte return values on return-reading trampoline paths btf_distill_func_proto() builds the function model used for the fentry/fexit/fmod_ret/fsession trampolines and struct_ops. It has accepted a 16-byte __int128 return value since the trampoline was introduced: __get_type_size() returns the integer's type size, and the return-type check only rejected ret < 0. But the BPF trampoline preserves only 8 bytes of the return value (RAX on x86, i.e. R0). For an attach type that reads the target's return value the second half (RDX / R3) is neither saved nor restored, so a program attached to a function returning a 16-byte value corrupts the value seen by the real caller and itself observes only half of it. struct_ops trampolines have the same limitation. This affects the attach types that read the target's return value: fexit, fmod_ret and fsession (plus the _multi variants of fexit and fsession), and struct_ops. fentry/fentry_multi run before the target returns and are unaffected. Reject a >8 byte return value for these attach types in bpf_check_attach_target() and bpf_check_attach_btf_id_multi(), and for struct_ops in bpf_struct_ops_desc_init().
02KernelScan AI Analysis
Risk summary
A local attacker with CAP_BPF can attach a BPF tracing program to a kernel function returning a 16-byte value, corrupting the return value seen by the real caller. The corruption is attacker-influenced and could potentially be leveraged for arbitrary kernel memory read or write if the return value is used as a pointer or size. Products that allow unprivileged BPF or grant CAP_BPF to containers are at higher risk.
Vulnerability analysis
The BPF trampoline saves and restores only 8 bytes of a target function's return value, but the verifier accepted functions returning 16-byte values such as __int128. When a BPF program is attached via fexit, fmod_ret, fsession, or struct_ops to such a function, the upper 8 bytes of the return value are neither saved nor restored — the real caller receives a corrupted return value and the BPF program itself observes only half of it. The fix adds explicit validation that rejects return types larger than 8 bytes for all attach types that read the target's return value, preventing the unsupported configuration from being loaded. This is reachable locally by any user who can load and attach a BPF tracing program, which requires CAP_BPF (or unprivileged BPF if enabled on the system).
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| mainline | 5.5 | 7.3-rc1 | c48796aa6c39 |
| 7.2 | 5.5 | 7.2.6 | d36ac53fc83b |