Linux kernel BPF verifier (atomic RMW destination pointer type tracking): The verifier recorded an instruction's

Impact

The verifier recorded an instruction's pointer type for atomic read-modify-write only when the destination was PTR_TO_ARENA. A second verification path could reach the same instruction with an ordinary pointer and never be compared against the saved arena type, while post-verification fixup rewrites that instruction to BPF_PROBE_ATOMIC for every path. The result is a verifier soundness hole: an atomic operation is executed in the kernel with a pointer type it was not checked for, which is the classic route from loading a BPF program to kernel memory corruption. On GPU nodes this matters wherever BPF program loading is reachable - observability agents, CNI dataplanes, or any workload granted CAP_BPF - because a kernel compromise there means the whole node and every tenant on it. NVD scores it local, low complexity, high on confidentiality, integrity and availability.

Who can reach it

Local user or container able to load BPF programs, i.e. holding CAP_BPF (or root) in a namespace that permits program load. Unprivileged BPF is disabled on most distributions, so a tenant pod without those capabilities cannot reach it.

What to do

Apply the stable kernel update that records the destination type for all atomic RMW paths (commits 4bc49ae344d6, d4ba9d888ac0, eb287c6e81de) and reboot each node. The verifier is built into the kernel image, so there is no daemon-restart or module-reload path in the record. In the meantime keep unprivileged BPF disabled and audit which workloads hold CAP_BPF. No fixed release numbers are given in the record.

References

Related entries

• Linux kernel BPF: use-after-free when multi-attach trampoline update fails and the still-live old image is freedCVE-2026-90210 · Linux kernel BPF trampoline (bpf_trampoline_multi_attach_free on update failure)High
• Linux kernel BPF verifier: iterator stack slots compared without pointer type, pruning an unsafe pathCVE-2026-90217 · Linux kernel BPF verifier (STACK_ITER slot type comparison during state pruning)High
• Linux kernel NVMe: SUBMIT_IO skips the command permission check, allowing writes through read-only handlesCVE-2026-90227 · Linux kernel NVMe ioctl (NVME_IOCTL_SUBMIT_IO missing nvme_cmd_allowed() check)High
• Linux kernel IOMMU DMA: unlocked msi_page_list corruption with two devices in one VFIO containerCVE-2026-90244 · Linux kernel iommu/dma (MSI page list locking under VFIO type1)High
• Linux kernel RDMA/siw: use-after-free in siw_accept() when the supplied QP is already in RTSCVE-2026-90292 · Linux kernel RDMA/siw (software iWARP, siw_accept() connection endpoint refcount)High
• Linux kernel RDMA/erdma: QP freed while async-event and CM handlers still use itCVE-2026-90308 · Linux kernel RDMA/erdma (QP lookup refcounting in AE and iWARP CM paths)High