CVE-2026-90195

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args

On RV64, the ABI requires sign-extension for signed 1-byte and 2-byte kfunc

args. However, the RV64 JIT currently does not perform sign-extension for

such kfunc args.

Before commit 7ce090afbf72 ("bpf: Infer zext_dst based on static register

liveness analysis"), state pruning could potentially omit zero-extension

of 32-bit subregisters, which inadvertently masked the above issue by making

the args appear as if they had been properly sign-extended. After that

commit, the problem is exposed, causing the kfunc_call/kfunc_call_test4

selftest to fail.

Fix this by extending the existing sign-extension logic to handle signed

1-byte and 2-byte kfunc args as well.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References