CVE-2026-90312

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Check load-acquire src ptr type before the load

check_atomic_load() calls check_load_mem() before atomic_ptr_type_ok().

For a load-acquire that fetches into its own source register (dst_reg ==

src_reg), check_load_mem() overwrites src_reg's type with the type of the

loaded value, so the subsequent atomic_ptr_type_ok() no longer sees the

source pointer and fails to reject the disallowed types (ctx, pkt,

flow_keys, sock).

Since bpf_convert_ctx_accesses() does not rewrite atomic loads, the raw

access to the underlying kernel object is left in place. The destination

type is taken from the ctx access itself, so a load-acquire of the sk

field of struct __sk_buff for example leaves the register typed as

PTR_TO_SOCK_COMMON_OR_NULL, which type_is_sk_pointer() does not match

either, while it actually holds unconverted struct sk_buff bytes. Once

the NULL check has passed this is a type confusion, not just a leak of

kernel

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References