CVE-2026-90359

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject >8 byte return values on return-reading trampoline paths

btf_distill_func_proto() builds the function model used for the

fentry/fexit/fmod_ret/fsession trampolines and struct_ops. It has

accepted a 16-byte __int128 return value since the trampoline was

introduced: __get_type_size() returns the integer's type size, and the

return-type check only rejected ret < 0.

But the BPF trampoline preserves only 8 bytes of the return value (RAX on

x86, i.e. R0). For an attach type that reads the target's return value the

second half (RDX / R3) is neither saved nor restored, so a program

attached to a function returning a 16-byte value corrupts the value seen

by the real caller and itself observes only half of it. struct_ops

trampolines have the same limitation.

This affects the attach types that read the target's return value: fexit,

fmod_ret and fsession (plus the _multi variants of fexit and fsession),

and struct_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References