FKIE_CVE-2026-90313

Vulnerability from fkie_nvd - Published: 2026-09-17 17:17 - Updated: 2026-09-17 17:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed A potential invalid storage access issue can occur after replacing a cgroup bpf prog. This occurs in the following scenario: 1. prog1 with storage is attached to a cgroup in multi-attach mode. 2. prog1 is replaced with prog2 using BPF_F_REPLACE in multi-attach mode, but fails midway (e.g. in bpf_trampoline_link_cgroup_shim or update_effective_progs). 3. A new prog3 is attached to the cgroup in multi-attach mode. The reason is that __cgroup_bpf_attach overwrites pl->storage with the new storage prior to attachment completion. When attachment fails midway, the cleanup path calls bpf_cgroup_storages_free(new_storage) to free the newly allocated storage, but fails to restore pl->storage back to old_storage. Consequently, the still-active prog1 holds invalid or dangling storage pointers, leading to an invalid memory access when prog1 executes and calls bpf_get_local_storage. Additionally, original pl->flags and cgrp->bpf.flags[atype] are left unrestored. Fix this by saving old_pl_flags, old_storage, and old_flags prior to the update, and properly restoring all of them in the cleanup path on error.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2c2218560b6e28a63ff7834ba26d09ff8efdee39
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6655c409707ec8ce9ce0850ffe4fe02331fd4d9c
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/86ead176301109b78e1d14c0e9d0d9ff9723c769
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/aaca16e042527f7efe48b50799bc662f1a191ce1
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e26db0d636e4c24a6b16683ea95cf5077c64d74b
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/cgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e26db0d636e4c24a6b16683ea95cf5077c64d74b",
              "status": "affected",
              "version": "7d9c3427894fe70d1347b4820476bf37736d2ff0",
              "versionType": "git"
            },
            {
              "lessThan": "aaca16e042527f7efe48b50799bc662f1a191ce1",
              "status": "affected",
              "version": "7d9c3427894fe70d1347b4820476bf37736d2ff0",
              "versionType": "git"
            },
            {
              "lessThan": "86ead176301109b78e1d14c0e9d0d9ff9723c769",
              "status": "affected",
              "version": "7d9c3427894fe70d1347b4820476bf37736d2ff0",
              "versionType": "git"
            },
            {
              "lessThan": "2c2218560b6e28a63ff7834ba26d09ff8efdee39",
              "status": "affected",
              "version": "7d9c3427894fe70d1347b4820476bf37736d2ff0",
              "versionType": "git"
            },
            {
              "lessThan": "6655c409707ec8ce9ce0850ffe4fe02331fd4d9c",
              "status": "affected",
              "version": "7d9c3427894fe70d1347b4820476bf37736d2ff0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/cgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed\n\nA potential invalid storage access issue can occur after replacing a\ncgroup bpf prog.\n\nThis occurs in the following scenario:\n1. prog1 with storage is attached to a cgroup in multi-attach mode.\n2. prog1 is replaced with prog2 using BPF_F_REPLACE in multi-attach\n   mode, but fails midway (e.g. in bpf_trampoline_link_cgroup_shim or\n   update_effective_progs).\n3. A new prog3 is attached to the cgroup in multi-attach mode.\n\nThe reason is that __cgroup_bpf_attach overwrites pl-\u003estorage with the\nnew storage prior to attachment completion. When attachment fails\nmidway, the cleanup path calls bpf_cgroup_storages_free(new_storage) to\nfree the newly allocated storage, but fails to restore pl-\u003estorage back\nto old_storage.\n\nConsequently, the still-active prog1 holds invalid or dangling storage\npointers, leading to an invalid memory access when prog1 executes and\ncalls bpf_get_local_storage. Additionally, original pl-\u003eflags and\ncgrp-\u003ebpf.flags[atype] are left unrestored.\n\nFix this by saving old_pl_flags, old_storage, and old_flags prior to the\nupdate, and properly restoring all of them in the cleanup path on error."
    }
  ],
  "id": "CVE-2026-90313",
  "lastModified": "2026-09-17T17:17:29.087",
  "metrics": {},
  "published": "2026-09-17T17:17:29.087",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2c2218560b6e28a63ff7834ba26d09ff8efdee39"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/6655c409707ec8ce9ce0850ffe4fe02331fd4d9c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/86ead176301109b78e1d14c0e9d0d9ff9723c769"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/aaca16e042527f7efe48b50799bc662f1a191ce1"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e26db0d636e4c24a6b16683ea95cf5077c64d74b"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.