CVE-2026-90358

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-90358
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90358.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-90358
Downstream
Published
2026-09-17T16:09:03Z
Modified
2026-09-19T03:47:26Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
bpf, x86: Fix trampoline stack size for 128-bit arguments
Details

In the Linux kernel, the following vulnerability has been resolved:

bpf, x86: Fix trampoline stack size for 128-bit arguments

btf_distill_func_proto() accepts a function argument up to 16 bytes, so a 128-bit scalar such as __int128 reaches the x86 trampoline with arg_size == 16. But the current implementation assumes an __int128 argument only needs one register, so the register save area is under-allocated and save_args() overwrites adjacent stack slots.

Compute the register count from arg_size for all arguments to fix it.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90358.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
a9c5ad31fbdc4dec6d266fe22e51de1ad6d1bcf2
Fixed
4aed2346fa9b88d458eeb8c01123f3c07585a675
Fixed
40f3bfbbb222b92278f3797614b70f68d46824ac
Fixed
a6d7d7a253c550e74b0651897fe313c2f9b2301f
Fixed
814cba835ef648e0c5eb79505c96c0493b29eea6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90358.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.1.0
Fixed
6.12.110
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.52
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90358.json"