SB20260918446 - Incorrect Comparison in Linux kernel bpf
Published: September 18, 2026
Security Bulletin ID
SB20260918446
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Incorrect Comparison (CVE-ID: CVE-2026-90217)
CWE-ID: CWE-697 - Incorrect Comparison
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to bypass BPF verifier safety checks.
The vulnerability exists due to improper comparison of iterator pointer types in BPF verifier state pruning when comparing iterator stack slots during BPF program verification. A local user can load a BPF program with iterator stack slots in different pointer states to bypass BPF verifier safety checks.
Remediation
Install update from vendor's website.