Linux kernel bpf x86: trampoline under-allocates the save area for __int128 arguments

Impact

btf_distill_func_proto() permits function arguments up to 16 bytes, so a 128-bit scalar such as __int128 arrives at the x86 trampoline with arg_size == 16, but the trampoline assumed one register per argument. The register save area is therefore too small and save_args() writes past it into adjacent kernel stack slots - a stack overwrite in generated trampoline code, scored 7.8 locally with full impact. Reaching it requires attaching a BPF trampoline program (fentry/fexit style) to a kernel function whose prototype takes a 128-bit scalar, so the realistic actor is a local context with BPF attach rights rather than a tenant pod with no capabilities. The fix computes register count from arg_size for every argument.

Who can reach it

Local: a context able to load and attach a BPF trampoline program (CAP_BPF/CAP_SYS_ADMIN in practice) targeting a kernel function with a 128-bit scalar argument. x86-64 hosts only; no remote vector.

What to do

Update to a stable kernel with the listed commits and reboot the node. Interim control is capability hygiene: do not grant BPF attach rights to workloads, and keep tracing agents that attach fentry programs under review. The record names no fixed vendor release, only the stable commits.

References

Related entries

• Linux kernel IOMMU DMA: allocation failure not detected in the non-blocking non-coherent pathCVE-2026-90388 · Linux kernel iommu/dma (atomic pool allocation failure check in the non-coherent path)High
• Linux kernel BPF: unprotected link->prog read races bpf_link_update into a use-after-freeCVE-2026-90392 · Linux kernel BPF link info (bpf_link_show_fdinfo / bpf_link_get_info_by_fd prog access)High
• Linux kernel RDMA/rxe: use-after-free when ODP memory-region registration failsCVE-2026-90423 · Linux kernel RDMA/rxe (soft-RoCE, on-demand paging MR init error path)High
• Linux vhost-scsi: stale response iovecs after a memory-table change write into unrelated memoryCVE-2026-93782 · Linux kernel vhost-scsi (VHOST_SET_MEM_TABLE vs in-flight command iovecs)High
• sudo: TZ from the calling user shifts NOTBEFORE/NOTAFTER windows, reviving expired rulesCVE-2026-96512 · sudo (NOTBEFORE/NOTAFTER sudoers time restrictions)High
• Linux slab allocator: ABA race in the optimistic freelist return corrupts the partial listCVE-2026-97941 · Linux kernel mm/slab (__slab_try_return_freelist ABA race)High