CVE-2026-90157

Summary

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject negative optlen in cgroup getsockopt hook

A cgroup getsockopt BPF program can shrink ctx->optlen after the kernel getsockopt handler has run. The kernel-buffer variant, used by TCP_ZEROCOPY_RECEIVE, only rejects values larger than the original length.

If BPF writes a negative optlen, that value is accepted and propagated back to the TCP getsockopt code. It can then be passed to copy_to_sockptr() as a size_t and trigger the hardened usercopy bytes > INT_MAX warning.

Reject negative ctx.optlen in __cgroup_bpf_run_filter_getsockopt_kern(), matching the lower-bound validation already present in the sockptr-based getsockopt hook.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux08f61a34913558e06576e7b6318bf583f273c1be < 5b09d984b38b018b123c3a9e02a96bbc6468dbe5affected
LinuxLinux9cacf81f8161111db25f98e78a7a0e32ae142b3f < 554ba7195c4108726450e24480c8449990c2268caffected
LinuxLinux9cacf81f8161111db25f98e78a7a0e32ae142b3f < d02a12b4085ffe41ea750b1007f7a9c7aee2875aaffected
LinuxLinux9cacf81f8161111db25f98e78a7a0e32ae142b3f < e6fbf0eba87f50084d67508898f6ad6fc7ff1ba2affected
LinuxLinux9cacf81f8161111db25f98e78a7a0e32ae142b3f < f68671b1a98d426c57864bd457c125fee14ac1a5affected
LinuxLinux9cacf81f8161111db25f98e78a7a0e32ae142b3f < 2bdbe00454200fcb0110f31eeca8d906a3515e74affected
LinuxLinux9cacf81f8161111db25f98e78a7a0e32ae142b3f < 31a89af4f513d750fec196e2bb6195a7d4473e9faffected
LinuxLinux9cacf81f8161111db25f98e78a7a0e32ae142b3f < 1b5aacd5b2419b0790e955e466d389a61c79b4b1affected
LinuxLinux5.10.188 < 5.10.270affected
LinuxLinux5.12affected
LinuxLinux0 < 5.12unaffected
LinuxLinux5.10.270 <= 5.10.*unaffected
LinuxLinux5.15.221 <= 5.15.*unaffected
LinuxLinux6.1.188 <= 6.1.*unaffected
LinuxLinux6.6.157 <= 6.6.*unaffected
LinuxLinux6.12.110 <= 6.12.*unaffected
LinuxLinux6.18.52 <= 6.18.*unaffected
LinuxLinux7.2.6 <= 7.2.*unaffected
LinuxLinux7.3-rc1 <= *unaffected

Weaknesses

References