{"id":"CVE-2026-90312","revision":"da7185005ca54511af5baf7f920707ac","records":[{"revision":"da7185005ca54511af5baf7f920707ac","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90312","aliases":[],"title":"bpf: Check load-acquire src ptr type before the load","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check load-acquire src ptr type before the load\n\ncheck_atomic_load() calls check_load_mem() before atomic_ptr_type_ok().\nFor a load-acquire that fetches into its own source register (dst_reg ==\nsrc_reg), check_load_mem() overwrites src_reg's type with the type of the\nloaded value, so the subsequent atomic_ptr_type_ok() no longer sees the\nsource pointer and fails to reject the disallowed types (ctx, pkt,\nflow_keys, sock).\n\nSince bpf_convert_ctx_accesses() does not rewrite atomic loads, the raw\naccess to the underlying kernel object is left in place. The destination\ntype is taken from the ctx access itself, so a load-acquire of the sk\nfield of struct __sk_buff for example leaves the register typed as\nPTR_TO_SOCK_COMMON_OR_NULL, which type_is_sk_pointer() does not match\neither, while it actually holds unconverted struct sk_buff bytes. Once\nthe NULL check has passed this is a type confusion, not just a leak of\nkernel data.\n\nValidate src_reg with check_reg_arg() and check the source pointer type\nwith atomic_ptr_type_ok() before the load again, mirroring\ncheck_atomic_rmw(). Out-of-range register numbers are already rejected\nearlier by check_and_resolve_insns() (commit 503d21ef8eac (\"bpf: Do\nregister range validation early\")), and the only exemption there,\nis_stack_arg_ldx(), requires BPF_LDX | BPF_MEM | BPF_DW and thus never\nmatches a BPF_ATOMIC insn. atomic_ptr_type_ok() can therefore not\ndereference register state out of bounds, that is, the out-of-bounds\nread addressed by the Fixes commit below does not reappear (as proven\nalso via selftest).","state":0,"publishedAt":"2026-09-17T16:08:32.287+00:00","modifiedAt":"2026-10-19T09:01:28.834+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/bpf/verifier.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"c03bb2fa327e4c25d6c5360a8803a4b1cdc2d0b9\",\n                            \"lessThan\": \"6ee7b00888498cf387dd30729e18a05328b94709\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c03bb2fa327e4c25d6c5360a8803a4b1cdc2d0b9\",\n                            \"lessThan\": \"422a416041172af1ac610736d5f556d22b31b115\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c03bb2fa327e4c25d6c5360a8803a4b1cdc2d0b9\",\n                            \"lessThan\": \"b87803391baa7e0bef60549d8841f12e549ad057\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/bpf/verifier.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.15\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.15\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.52\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/6ee7b00888498cf387dd30729e18a05328b94709","https://git.kernel.org/stable/c/422a416041172af1ac610736d5f556d22b31b115","https://git.kernel.org/stable/c/b87803391baa7e0bef60549d8841f12e549ad057"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90312","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90312","identifiers":["CVE-2026-90312"]},"retained":false,"historicalAffected":[]}],"coverage":[]}