CVE-2026-90359

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. When BPF programs are attached to functions that return 16-byte values using specific trampoline types (such as fexit, fmod_ret, fsession, or struct_ops), the BPF trampoline incorrectly preserves only 8 bytes of the return value. This leads to data corruption, where the actual caller and the attached BPF program observe an incomplete and corrupted return value, potentially causing unexpected system behavior.

BPF return reading trampoline paths accepted target functions with return values larger than 8 bytes. On common ABIs a 16 byte return value is passed in a register pair, but the trampoline preserves only the first 8 bytes, so fexit, fmod_ret, fsession, and struct_ops programs can corrupt the return value observed by the real caller and can observe only half of it. For the CVSS the PR:L is used for the paranoid score because a local user or service with delegated BPF tracing or struct_ops loading capability may be enough in some deployments, although typical systems restrict this to administrator level capabilities. The issue is not network reachable and requires local BPF program loading and attachment. Impact is mainly integrity corruption of kernel function results and possible denial of service, with no concrete information leak or arbitrary write primitive shown.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.