{"id":"CVE-2026-90157","revision":"a48f437302e243059169cf5bca77a5ea","records":[{"revision":"a48f437302e243059169cf5bca77a5ea","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90157","aliases":[],"title":"bpf: Reject negative optlen in cgroup getsockopt hook","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject negative optlen in cgroup getsockopt hook\n\nA cgroup getsockopt BPF program can shrink ctx->optlen after the\nkernel getsockopt handler has run. The kernel-buffer variant, used by\nTCP_ZEROCOPY_RECEIVE, only rejects values larger than the original\nlength.\n\nIf BPF writes a negative optlen, that value is accepted and propagated\nback to the TCP getsockopt code. It can then be passed to\ncopy_to_sockptr() as a size_t and trigger the hardened usercopy\nbytes > INT_MAX warning.\n\nReject negative ctx.optlen in __cgroup_bpf_run_filter_getsockopt_kern(),\nmatching the lower-bound validation already present in the sockptr-based\ngetsockopt hook.","state":0,"publishedAt":"2026-09-17T16:06:49.081+00:00","modifiedAt":"2026-10-19T08:58:55.961+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/bpf/cgroup.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"08f61a34913558e06576e7b6318bf583f273c1be\",\n                            \"lessThan\": \"5b09d984b38b018b123c3a9e02a96bbc6468dbe5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9cacf81f8161111db25f98e78a7a0e32ae142b3f\",\n                            \"lessThan\": \"554ba7195c4108726450e24480c8449990c2268c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9cacf81f8161111db25f98e78a7a0e32ae142b3f\",\n                            \"lessThan\": \"d02a12b4085ffe41ea750b1007f7a9c7aee2875a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9cacf81f8161111db25f98e78a7a0e32ae142b3f\",\n                            \"lessThan\": \"e6fbf0eba87f50084d67508898f6ad6fc7ff1ba2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9cacf81f8161111db25f98e78a7a0e32ae142b3f\",\n                            \"lessThan\": \"f68671b1a98d426c57864bd457c125fee14ac1a5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9cacf81f8161111db25f98e78a7a0e32ae142b3f\",\n                            \"lessThan\": \"2bdbe00454200fcb0110f31eeca8d906a3515e74\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9cacf81f8161111db25f98e78a7a0e32ae142b3f\",\n                            \"lessThan\": \"31a89af4f513d750fec196e2bb6195a7d4473e9f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9cacf81f8161111db25f98e78a7a0e32ae142b3f\",\n                            \"lessThan\": \"1b5aacd5b2419b0790e955e466d389a61c79b4b1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5.10.188\",\n                            \"lessThan\": \"5.10.270\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/bpf/cgroup.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.12\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.12\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.270\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.221\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.52\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/5b09d984b38b018b123c3a9e02a96bbc6468dbe5","https://git.kernel.org/stable/c/554ba7195c4108726450e24480c8449990c2268c","https://git.kernel.org/stable/c/d02a12b4085ffe41ea750b1007f7a9c7aee2875a","https://git.kernel.org/stable/c/e6fbf0eba87f50084d67508898f6ad6fc7ff1ba2","https://git.kernel.org/stable/c/f68671b1a98d426c57864bd457c125fee14ac1a5","https://git.kernel.org/stable/c/2bdbe00454200fcb0110f31eeca8d906a3515e74","https://git.kernel.org/stable/c/31a89af4f513d750fec196e2bb6195a7d4473e9f","https://git.kernel.org/stable/c/1b5aacd5b2419b0790e955e466d389a61c79b4b1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90157","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90157","identifiers":["CVE-2026-90157"]},"retained":false,"historicalAffected":[]}],"coverage":[]}