CVE-2026-92520

Summary

In the Linux kernel, the following vulnerability has been resolved:

bpf: Zero queue and stack outputs on lock failure

Queue and stack pop/peek helpers accept an uninitialized output buffer because the verifier expects the helper to initialize it. The empty-map error path clears the buffer, but a failed lock acquisition returns -EBUSY without writing it.

Clear the output before returning -EBUSY so BPF programs cannot observe uninitialized stack contents after a failed helper call.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxa34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 < 1534c4bff3aaca19c4c9a82f93e9b81f7c983de3affected
LinuxLinuxa34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 < e2396b8a562073787e627a5f483f1bc5c452fa6aaffected
LinuxLinuxa34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 < 7ac6e1ae41a09f1dd4baeeff1d028ae49ee01232affected
LinuxLinux40e34ea01748e5b8afdd40a172868be1e1ab0edeaffected
LinuxLinux388c9d3eefaea99828ee5000c693128a5b41ee7caffected
LinuxLinuxacabf5df49aa3a4f9c96200102d893351b511a88affected
LinuxLinuxe388671635acf470f0986d874389148fd234620baffected
LinuxLinux232f0ba4d69263af5912e279fcc32fef2882b1dcaffected
LinuxLinux5.4.258 < 5.5affected
LinuxLinux5.10.198 < 5.11affected
LinuxLinux5.15.134 < 5.16affected
LinuxLinux6.1.56 < 6.2affected
LinuxLinux6.5.6 < 6.6affected
LinuxLinux6.6affected
LinuxLinux0 < 6.6unaffected
LinuxLinux6.18.52 <= 6.18.*unaffected
LinuxLinux7.2.6 <= 7.2.*unaffected
LinuxLinux7.3-rc1 <= *unaffected

Weaknesses

References