CVE-2026-92520 PUBLISHED

bpf: Zero queue and stack outputs on lock failure

Assigner: Linux
Reserved: 16.09.2026 Published: 17.09.2026 Updated: 17.09.2026

In the Linux kernel, the following vulnerability has been resolved:

bpf: Zero queue and stack outputs on lock failure

Queue and stack pop/peek helpers accept an uninitialized output buffer because the verifier expects the helper to initialize it. The empty-map error path clears the buffer, but a failed lock acquisition returns -EBUSY without writing it.

Clear the output before returning -EBUSY so BPF programs cannot observe uninitialized stack contents after a failed helper call.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 to 1534c4bff3aaca19c4c9a82f93e9b81f7c983de3 (excl.)
  • affected from a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 to e2396b8a562073787e627a5f483f1bc5c452fa6a (excl.)
  • affected from a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 to 7ac6e1ae41a09f1dd4baeeff1d028ae49ee01232 (excl.)
  • Version 40e34ea01748e5b8afdd40a172868be1e1ab0ede is affected
  • Version 388c9d3eefaea99828ee5000c693128a5b41ee7c is affected
  • Version acabf5df49aa3a4f9c96200102d893351b511a88 is affected
  • Version e388671635acf470f0986d874389148fd234620b is affected
  • Version 232f0ba4d69263af5912e279fcc32fef2882b1dc is affected
  • affected from 5.4.258 to 5.5 (excl.)
  • affected from 5.10.198 to 5.11 (excl.)
  • affected from 5.15.134 to 5.16 (excl.)
  • affected from 6.1.56 to 6.2 (excl.)
  • affected from 6.5.6 to 6.6 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 6.6 is affected
  • unaffected from 0 to 6.6 (excl.)
  • unaffected from 6.18.52 to 6.18.* (incl.)
  • unaffected from 7.2.6 to 7.2.* (incl.)
  • unaffected from 7.3-rc1 to * (incl.)

References