CVE-2026-90143 (GCVE-0-2026-90143)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:06 – Updated: 2026-09-18 17:53
VLAI
Title
net: kcm: Hold RCU read lock while running BPF parser
Summary
In the Linux kernel, the following vulnerability has been resolved: net: kcm: Hold RCU read lock while running BPF parser kcm_parse_func_strparser() calls bpf_prog_run_pin_on_cpu() which prevents CPU migration, but does not establish an RCU read-side critical section. Consequently, BPF map operations can trigger WARN_ON_ONCE(!bpf_rcu_lock_held()) when called from the KCM strparser program. Hold the RCU read lock while running the program.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9b73896a81dc68a638a011877b7344b252f92276 , < 37108861cf7bd909d4a372069bcd61c8f489e232 (git)
Affected: 9b73896a81dc68a638a011877b7344b252f92276 , < 3c70d27e792a28bca650ddd8a9aa0fe3591ffec5 (git)
Affected: 9b73896a81dc68a638a011877b7344b252f92276 , < 1d26a6e007d46babc7fa76e5a157dccf86cd55c0 (git)
Affected: 9b73896a81dc68a638a011877b7344b252f92276 , < b0e94ea63dbdcbfec9beb819cd5f8fa584809ef2 (git)
Affected: 9b73896a81dc68a638a011877b7344b252f92276 , < 21526f8a191a3c50622b8c10bd927870d780eae4 (git)
Affected: 9b73896a81dc68a638a011877b7344b252f92276 , < 292846223eaddba890e40699d2ab82ee5671798c (git)
Affected: 9b73896a81dc68a638a011877b7344b252f92276 , < f392affef3c9ce64dfdde794df0579e0a7793440 (git)
Affected: 9b73896a81dc68a638a011877b7344b252f92276 , < b0346dd64e4905291cc9c479f2e6cf1884ced4e6 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.9
Unaffected: 0 , < 4.9 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/kcm/kcmsock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "37108861cf7bd909d4a372069bcd61c8f489e232",
              "status": "affected",
              "version": "9b73896a81dc68a638a011877b7344b252f92276",
              "versionType": "git"
            },
            {
              "lessThan": "3c70d27e792a28bca650ddd8a9aa0fe3591ffec5",
              "status": "affected",
              "version": "9b73896a81dc68a638a011877b7344b252f92276",
              "versionType": "git"
            },
            {
              "lessThan": "1d26a6e007d46babc7fa76e5a157dccf86cd55c0",
              "status": "affected",
              "version": "9b73896a81dc68a638a011877b7344b252f92276",
              "versionType": "git"
            },
            {
              "lessThan": "b0e94ea63dbdcbfec9beb819cd5f8fa584809ef2",
              "status": "affected",
              "version": "9b73896a81dc68a638a011877b7344b252f92276",
              "versionType": "git"
            },
            {
              "lessThan": "21526f8a191a3c50622b8c10bd927870d780eae4",
              "status": "affected",
              "version": "9b73896a81dc68a638a011877b7344b252f92276",
              "versionType": "git"
            },
            {
              "lessThan": "292846223eaddba890e40699d2ab82ee5671798c",
              "status": "affected",
              "version": "9b73896a81dc68a638a011877b7344b252f92276",
              "versionType": "git"
            },
            {
              "lessThan": "f392affef3c9ce64dfdde794df0579e0a7793440",
              "status": "affected",
              "version": "9b73896a81dc68a638a011877b7344b252f92276",
              "versionType": "git"
            },
            {
              "lessThan": "b0346dd64e4905291cc9c479f2e6cf1884ced4e6",
              "status": "affected",
              "version": "9b73896a81dc68a638a011877b7344b252f92276",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/kcm/kcmsock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: kcm: Hold RCU read lock while running BPF parser\n\nkcm_parse_func_strparser() calls bpf_prog_run_pin_on_cpu() which\nprevents CPU migration, but does not establish an RCU read-side\ncritical section. Consequently, BPF map operations can trigger\nWARN_ON_ONCE(!bpf_rcu_lock_held()) when called from the KCM strparser\nprogram.\n\nHold the RCU read lock while running the program."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The missing rcu_read_lock is in kcm_parse_func_strparser(), reached after local socket(AF_KCM) and ioctl(SIOCKCMATTACH) installing the caller\u0027s BPF_PROG_TYPE_SOCKET_FILTER via bpf_prog_get_type(). A remote TCP peer can only feed an skb into strp_recv(); map helpers fire regardless of payload, and the BPF program is locally supplied.\nAC:L - kcm_attach() always calls strp_check_rcv(), which queues do_strp_work so parse_msg runs in process context under lock_sock() with BH enabled, so bpf_rcu_lock_held() is false. The attacker loads a SOCKET_FILTER that calls bpf_map_lookup_elem and can delete the same HASH key from their own map fd on another thread.\nPR:L - kcm_create() and kcm_ioctl(SIOCKCMATTACH) have no capable() check, and PF_KCM autoloads via MODULE_ALIAS_NETPROTO. bpf_prog_get_type(..., BPF_PROG_TYPE_SOCKET_FILTER) and HASH/ARRAY maps are the unprivileged types in bpf_prog_load()/map_create(); CAP_BPF in the init namespace is not required when unprivileged BPF is enabled.\nUI:N - The attacker opens their own AF_KCM and TCP sockets, loads their own SOCKET_FILTER, issues SIOCKCMATTACH, and either pre-queues TCP data so strp_check_rcv() runs the parser or writes the TCP peer themselves. No other user must mount a filesystem, open a device, or attach a program.\nS:U - A dangling htab_elem used by kcm_parse_func_strparser() is a host-kernel use-after-free that can escalate privileges inside the same kernel. It does not cross a KVM/Xen guest-host boundary or an IOMMU/DMA domain.\nC:H - bpf_map_lookup_elem() proceeds after WARN_ON_ONCE(!bpf_rcu_lock_held()) and __htab_map_lookup_elem() still returns a pointer. Concurrent htab delete via the attacker\u0027s map fd frees or freelist-reuses that htab_elem (bpf_mem_cache_free/pcpu_freelist_push) while the SOCKET_FILTER still reads the map value, disclosing kernel heap.\nI:H - The verifier treats the map-value pointer as writable, so the SOCKET_FILTER can store through the dangling htab_elem after free_htab_elem() reuses it, and bpf_map_update_elem() also runs without RCU from kcm_parse_func_strparser(). That is an arbitrary kernel write via heap reuse, not a bounded overwrite.\nA:H - Use of the dangling htab_elem in do_strp_work oopses or panics the kernel. Independently, bpf_map_lookup_elem()/__htab_map_lookup_elem() hit WARN_ON_ONCE(!bpf_rcu_lock_held()) on the first map helper from kcm_parse_func_strparser(), which is fatal on kernels booted with panic_on_warn."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:53:21.163Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/37108861cf7bd909d4a372069bcd61c8f489e232"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c70d27e792a28bca650ddd8a9aa0fe3591ffec5"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d26a6e007d46babc7fa76e5a157dccf86cd55c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/b0e94ea63dbdcbfec9beb819cd5f8fa584809ef2"
        },
        {
          "url": "https://git.kernel.org/stable/c/21526f8a191a3c50622b8c10bd927870d780eae4"
        },
        {
          "url": "https://git.kernel.org/stable/c/292846223eaddba890e40699d2ab82ee5671798c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f392affef3c9ce64dfdde794df0579e0a7793440"
        },
        {
          "url": "https://git.kernel.org/stable/c/b0346dd64e4905291cc9c479f2e6cf1884ced4e6"
        }
      ],
      "title": "net: kcm: Hold RCU read lock while running BPF parser",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90143",
    "datePublished": "2026-09-17T16:06:39.775Z",
    "dateReserved": "2026-09-11T19:38:34.789Z",
    "dateUpdated": "2026-09-18T17:53:21.163Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90143",
      "date": "2026-09-25",
      "epss": "0.00176",
      "percentile": "0.06314"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-24T01:42:22.000Z",
      "cve": "CVE-2026-90143",
      "id": "msrc_CVE-2026-90143",
      "initial_release_date": "2026-09-19T01:14:51.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: kcm: Hold RCU read lock while running BPF parser",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-90143.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/kcm/kcmsock.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "37108861cf7bd909d4a372069bcd61c8f489e232",
                    "status": "affected",
                    "version": "9b73896a81dc68a638a011877b7344b252f92276",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3c70d27e792a28bca650ddd8a9aa0fe3591ffec5",
                    "status": "affected",
                    "version": "9b73896a81dc68a638a011877b7344b252f92276",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1d26a6e007d46babc7fa76e5a157dccf86cd55c0",
                    "status": "affected",
                    "version": "9b73896a81dc68a638a011877b7344b252f92276",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b0e94ea63dbdcbfec9beb819cd5f8fa584809ef2",
                    "status": "affected",
                    "version": "9b73896a81dc68a638a011877b7344b252f92276",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "21526f8a191a3c50622b8c10bd927870d780eae4",
                    "status": "affected",
                    "version": "9b73896a81dc68a638a011877b7344b252f92276",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "292846223eaddba890e40699d2ab82ee5671798c",
                    "status": "affected",
                    "version": "9b73896a81dc68a638a011877b7344b252f92276",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f392affef3c9ce64dfdde794df0579e0a7793440",
                    "status": "affected",
                    "version": "9b73896a81dc68a638a011877b7344b252f92276",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b0346dd64e4905291cc9c479f2e6cf1884ced4e6",
                    "status": "affected",
                    "version": "9b73896a81dc68a638a011877b7344b252f92276",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/kcm/kcmsock.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.9"
                  },
                  {
                    "lessThan": "4.9",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: kcm: Hold RCU read lock while running BPF parser\n\nkcm_parse_func_strparser() calls bpf_prog_run_pin_on_cpu() which\nprevents CPU migration, but does not establish an RCU read-side\ncritical section. Consequently, BPF map operations can trigger\nWARN_ON_ONCE(!bpf_rcu_lock_held()) when called from the KCM strparser\nprogram.\n\nHold the RCU read lock while running the program."
          }
        ],
        "id": "CVE-2026-90143",
        "lastModified": "2026-09-18T18:17:43.690",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:07.097",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1d26a6e007d46babc7fa76e5a157dccf86cd55c0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/21526f8a191a3c50622b8c10bd927870d780eae4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/292846223eaddba890e40699d2ab82ee5671798c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/37108861cf7bd909d4a372069bcd61c8f489e232"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3c70d27e792a28bca650ddd8a9aa0fe3591ffec5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b0346dd64e4905291cc9c479f2e6cf1884ced4e6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b0e94ea63dbdcbfec9beb819cd5f8fa584809ef2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f392affef3c9ce64dfdde794df0579e0a7793440"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.