CVE-2026-90300

CVE-2026-90300

published September 17, 2026

CVSS
—
EPSS
0%
Percentile
10.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

bpf: Clear buf on error in __bpf_get_task_stack

Both bpf_get_task_stack and bpf_get_task_stack_sleepable helpers that

use __bpf_get_task_stack have buf defined as ARG_PTR_TO_UNINIT_MEM

argument and we should initialize the buf on every return path.

Adding missing buf memset for __bpf_get_task_stack fail paths. This

provides deterministic buffer contents, which is useful when the buffer

is used directly as a map key.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00209 · 10.5th percentile
Published
2026-09-17T21:17Z
References (5)
EPSS history
Timeline
  • 19 SEP 03:55Z
    EPSS moved — → 0%
    epss
  • 17 SEP 16:08Z
    bpf: Clear buf on error in __bpf_get_task_stack
    cvelistv5