SB20260918369 - Improper input validation in Linux kernel bpf

Description

This security bulletin contains information about 1 vulnerability.

1) Improper input validation (CVE-ID: CVE-2026-90299)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the BPF verifier's sleepable-program target check when attaching a sleepable tracing BPF program to a BPF program target with a '__x64_'-alike prefix. A local user can attach a sleepable tracing BPF program to such a target to cause a denial of service.

The issue occurs when CONFIG_FUNCTION_ERROR_INJECTION is disabled.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/00244bdaa423d93f4571f3f6854378ce3365e524
• https://git.kernel.org/stable/c/976f1be72740cfbc351d3841fd21186dda3ea723