SB2026091901 - Improper initialization in Linux kernel s390 net

Description

This security bulletin contains information about 1 vulnerability.

1) Improper initialization (CVE-ID: CVE-2026-90211)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause BPF programs to retain stale register values after faulting atomic operations.

The vulnerability exists due to improper initialization in bpf_jit_probe_atomic_pre() in the s390 BPF JIT compiler when processing faulting BPF_PROBE_ATOMIC read-modify-write operations. A local user can execute a BPF program containing a faulting arena atomic operation to cause BPF programs to retain stale register values after faulting atomic operations.

Only read-modify-write atomic operations carrying BPF_FETCH and BPF_CMPXCHG read an old value into a register.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1a26541b3f60ce447433a4c4dd56edb10d2cd580
• https://git.kernel.org/stable/c/44b702fceb4cf3a4ddbfb496f487b034814bf1a3
• https://git.kernel.org/stable/c/cc3e12330599f097f0e1f792435686ddc276f26d