CVE-2026-90177

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) verifier. This vulnerability arises because the atomic Read-Modify-Write (RMW) verification process does not consistently check pointer types across all execution paths. Specifically, it only records the instruction pointer type when the destination is a specific memory region (PTR_TO_ARENA), allowing other paths to use ordinary pointers without proper type comparison. This inconsistency could enable a bypass of security checks within the BPF verifier, potentially leading to unintended operations or integrity issues within the kernel.

A BPF verifier type tracking flaw can allow the same atomic RMW instruction to be reached with incompatible destination pointer types, because the old logic recorded the pointer type only for PTR_TO_ARENA paths. The post verification fixup then uses the saved type for every path and may rewrite the instruction to BPF_PROBE_ATOMIC even when another path uses a non arena pointer. For the CVSS the PR:L is used because an attacker needs local ability to load or run BPF programs, for example through BPF permissions or delegated capabilities, but not necessarily full root privileges. The issue is not network reachable and requires local code execution or a local process context. Impact is at least local denial of service via verifier or JIT miscompilation, and in the paranoid case may include confidentiality and integrity impact due to a plausible kernel memory safety risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.