CVE-2026-90300

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. The __bpf_get_task_stack helper function, used by bpf_get_task_stack and bpf_get_task_stack_sleepable, fails to clear a buffer (buf) on error paths. This oversight can lead to non-deterministic buffer contents, potentially resulting in information disclosure when the buffer is subsequently used, for example, as a map key.

A moderate severity flaw was found in the Linux kernel BPF (Berkeley Packet Filter) subsystem as shipped in Red Hat Enterprise Linux and other Red Hat products that carry affected kernel versions. The __bpf_get_task_stack() helper, used by the bpf_get_task_stack() and bpf_get_task_stack_sleepable() BPF helper functions, does not initialize the caller-supplied buffer (declared ARG_PTR_TO_UNINIT_MEM) on error return paths. As a result, the buffer retains non-deterministic, uninitialized contents after a failed call, and a local user able to load and run BPF programs that use the affected helpers could expose uninitialized kernel memory, for example when the buffer is subsequently used directly as a BPF map key.

The vulnerable code, introduced upstream in kernel 5.12 in kernel/bpf/stackmap.c, is present in Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS 2, and the RHEL CoreOS 8/9 kernels shipped with OpenShift Container Platform 4. For these affected streams the fix is currently deferred, as the flaw is rated moderate impact and exploitation requires local access and the ability to run BPF programs that use the affected helpers; the residual risk is that such a local user could read non-deterministic uninitialized kernel memory contents. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those kernel versions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.