Incorrect Comparison in Linux kernel - CVE-2026-90217
Published: September 18, 2026
Vulnerability identifier: #VU151259
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-90217
CWE-ID: CWE-697
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to bypass BPF verifier safety checks.
The vulnerability exists due to improper comparison of iterator pointer types in BPF verifier state pruning when comparing iterator stack slots during BPF program verification. A local user can load a BPF program with iterator stack slots in different pointer states to bypass BPF verifier safety checks.
Affected software
Linux kernel
How to mitigate CVE-2026-90217
Install security update from vendor's repository.