FKIE_CVE-2026-90159

Vulnerability from fkie_nvd - Published: 2026-09-17 17:17 - Updated: 2026-09-17 17:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks _bpf_setsockopt() and _bpf_getsockopt() call sock_owned_by_me() for full sockets, so these helpers expect the socket lock to be held. BPF_CGROUP_UNIX_GETPEERNAME and BPF_CGROUP_UNIX_GETSOCKNAME run BPF programs without acquiring the socket lock. A program attached to either hook can therefore trigger the sock_owned_by_me() warning by calling bpf_setsockopt() or bpf_getsockopt(). Disallow bpf_setsockopt() and bpf_getsockopt() for CGROUP_UNIX_GETPEERNAME and CGROUP_UNIX_GETSOCKNAME.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/61769b9c882a964af3a6ebd9a8e43615f8713234
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/84473a7e1813a2da7b759ab1d098a84998c8d3f5
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/daeb74f5f398e847d1d42906aec6610406a34fdc
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fe91c3f64a738dd97e8542ad5bdfbe5ac430edf6
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "61769b9c882a964af3a6ebd9a8e43615f8713234",
              "status": "affected",
              "version": "859051dd165ec6cc915f0f2114699021144fd249",
              "versionType": "git"
            },
            {
              "lessThan": "fe91c3f64a738dd97e8542ad5bdfbe5ac430edf6",
              "status": "affected",
              "version": "859051dd165ec6cc915f0f2114699021144fd249",
              "versionType": "git"
            },
            {
              "lessThan": "daeb74f5f398e847d1d42906aec6610406a34fdc",
              "status": "affected",
              "version": "859051dd165ec6cc915f0f2114699021144fd249",
              "versionType": "git"
            },
            {
              "lessThan": "84473a7e1813a2da7b759ab1d098a84998c8d3f5",
              "status": "affected",
              "version": "859051dd165ec6cc915f0f2114699021144fd249",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks\n\n_bpf_setsockopt() and _bpf_getsockopt() call sock_owned_by_me() for\nfull sockets, so these helpers expect the socket lock to be held.\n\nBPF_CGROUP_UNIX_GETPEERNAME and BPF_CGROUP_UNIX_GETSOCKNAME run BPF\nprograms without acquiring the socket lock. A program attached to\neither hook can therefore trigger the sock_owned_by_me() warning by\ncalling bpf_setsockopt() or bpf_getsockopt().\n\nDisallow bpf_setsockopt() and bpf_getsockopt() for CGROUP_UNIX_GETPEERNAME\nand CGROUP_UNIX_GETSOCKNAME."
    }
  ],
  "id": "CVE-2026-90159",
  "lastModified": "2026-09-17T17:17:09.080",
  "metrics": {},
  "published": "2026-09-17T17:17:09.080",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/61769b9c882a964af3a6ebd9a8e43615f8713234"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/84473a7e1813a2da7b759ab1d098a84998c8d3f5"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/daeb74f5f398e847d1d42906aec6610406a34fdc"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/fe91c3f64a738dd97e8542ad5bdfbe5ac430edf6"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.