CVE-2026-90359

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject >8 byte return values on return-reading trampoline paths

btf_distill_func_proto() builds the function model used for the

fentry/fexit/fmod_ret/fsession trampolines and struct_ops. It has

accepted a 16-byte __int128 return value since the trampoline was

introduced: __get_type_size() returns the integer's type size, and the

return-type check only rejected ret < 0.

But the BPF trampoline preserves only 8 bytes of the return value (RAX on

x86, i.e. R0). For an attach type that reads the target's return value the

second half (RDX / R3) is neither saved nor restored, so a program

attached to a function returning a 16-byte value corrupts the value seen

by the real caller and itself observes only half of it. struct_ops

trampolines have the same limitation.

This affects the attach types that read the target's return value: fexit,

fmod_ret and fsession (plus the _multi variants of fexit and fsession),

and struct_ops. fentry/fentry_multi run before the target returns and are

unaffected.

Reject a >8 byte return value for these attach types in

bpf_check_attach_target() and bpf_check_attach_btf_id_multi(), and for

struct_ops in bpf_struct_ops_desc_init().