CVE-2026-90300 PUBLISHED

bpf: Clear buf on error in __bpf_get_task_stack

Assigner: Linux
Reserved: 11.09.2026 Published: 17.09.2026 Updated: 17.09.2026

In the Linux kernel, the following vulnerability has been resolved:

bpf: Clear buf on error in __bpf_get_task_stack

Both bpf_get_task_stack and bpf_get_task_stack_sleepable helpers that use __bpf_get_task_stack have buf defined as ARG_PTR_TO_UNINIT_MEM argument and we should initialize the buf on every return path.

Adding missing buf memset for __bpf_get_task_stack fail paths. This provides deterministic buffer contents, which is useful when the buffer is used directly as a map key.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 06ab134ce8ecfa5a69e850f88f81c8a4c3fa91df to f523359c4789bb0396d2d642464a6e2fd4f2299d (excl.)
  • affected from 06ab134ce8ecfa5a69e850f88f81c8a4c3fa91df to f5d242825ca417bb6afe35fde6e8880f97ca43fb (excl.)
  • Version d921baabd96445ef9c9c9410ca06164359c8a1a5 is affected
  • Version 9c020a533eaae1c2d41a7e3835c4c818a9b4b656 is affected
  • Version ff6bdc205fd0a83bd365405d4e31fb5905826996 is affected
  • affected from 5.10.30 to 5.11 (excl.)
  • affected from 5.11.14 to 5.12 (excl.)
  • affected from 5.10.96 to 5.11 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 5.12 is affected
  • unaffected from 0 to 5.12 (excl.)
  • unaffected from 7.2.6 to 7.2.* (incl.)
  • unaffected from 7.3-rc1 to * (incl.)

References