{"id":"CVE-2026-90211","revision":"7cc7afaac6164a258fb3301c6d549344","records":[{"revision":"7cc7afaac6164a258fb3301c6d549344","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90211","aliases":[],"title":"bpf, s390: Clear fetch destination on faulting arena atomic","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, s390: Clear fetch destination on faulting arena atomic\n\nSame missing register clear as on riscv64. A RMW atomic on an arena pointer\nis converted to BPF_PROBE_ATOMIC and gets an exception table entry, but\nbpf_jit_probe_atomic_pre() only fills in the arena base and the probe\noffset, leaving probe->reg at the -1 that bpf_jit_probe_init() set, which\nbpf_jit_probe_post() writes into the entry and ex_handler_bpf() then reads\nback as \"there is nothing to clear\".\n\nThat is right for a plain BPF_{ADD,AND,OR,XOR}, which only writes memory,\nbut an RMW carrying BPF_FETCH also reads the old value into a register:\nsrc_reg for BPF_{ADD,AND,OR,XOR} | BPF_FETCH and BPF_XCHG, and r0 for\nBPF_CMPXCHG. So on a fault over an unmapped arena page the program resumes\nat the landing pad with whatever that register held before the atomic\ninstead of the 0 that every other BPF_PROBE_* access delivers.\n\nFill probe->reg in from bpf_atomic_load_reg(). Unlike x86-64 and arm64,\ns390x does not report arena violations from its exception handler, so there\nis no access direction to correct here, only the missing register clear.","state":0,"publishedAt":"2026-09-17T16:07:25.454+00:00","modifiedAt":"2026-10-19T08:59:47.377+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"arch/s390/net/bpf_jit_comp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2f9469484a3b52c66b799de73bd1ca75617bc8d5\",\n                            \"lessThan\": \"44b702fceb4cf3a4ddbfb496f487b034814bf1a3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2f9469484a3b52c66b799de73bd1ca75617bc8d5\",\n                            \"lessThan\": \"cc3e12330599f097f0e1f792435686ddc276f26d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"arch/s390/net/bpf_jit_comp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.11\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.11\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/44b702fceb4cf3a4ddbfb496f487b034814bf1a3","https://git.kernel.org/stable/c/cc3e12330599f097f0e1f792435686ddc276f26d"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90211","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90211","identifiers":["CVE-2026-90211"]},"retained":false,"historicalAffected":[]}],"coverage":[]}