{"id":"CVE-2026-90211","state":"PUBLISHED","title":"bpf, s390: Clear fetch destination on faulting arena atomic","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, s390: Clear fetch destination on faulting arena atomic\n\nSame missing register clear as on riscv64. A RMW atomic on an arena pointer\nis converted to BPF_PROBE_ATOMIC and gets an exception table entry, but\nbpf_jit_probe_atomic_pre() only fills in the arena base and the probe\noffset, leaving probe->reg at the -1 that bpf_jit_probe_init() set, which\nbpf_jit_probe_post() writes into the entry and ex_handler_bpf() then reads\nback as \"there is nothing to clear\".\n\nThat is right for a plain BPF_{ADD,AND,OR,XOR}, which only writes memory,\nbut an RMW carrying BPF_FETCH also reads the old value into a register:\nsrc_reg for BPF_{ADD,AND,OR,XOR} | BPF_FETCH and BPF_XCHG, and r0 for\nBPF_CMPXCHG. So on a fault over an unmapped arena page the program resumes\nat the landing pad with whatever that register held before the atomic\ninstead of the 0 that every other BPF_PROBE_* access delivers.\n\nFill probe->reg in from bpf_atomic_load_reg(). Unlike x86-64 and arm64,\ns390x does not report arena violations from its exception handler, so there\nis no access direction to correct here, only the missing register clear.","publishedAt":"2026-09-17T16:07:25.454Z","updatedAt":"2026-10-19T08:59:47.377Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"2f9469484a3b52c66b799de73bd1ca75617bc8d5","status":"affected","lessThan":"44b702fceb4cf3a4ddbfb496f487b034814bf1a3","versionType":"git"},{"version":"2f9469484a3b52c66b799de73bd1ca75617bc8d5","status":"affected","lessThan":"cc3e12330599f097f0e1f792435686ddc276f26d","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/s390/net/bpf_jit_comp.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.11","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.11","versionType":"semver"},{"version":"7.2.6","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/s390/net/bpf_jit_comp.c"]}],"references":["https://git.kernel.org/stable/c/44b702fceb4cf3a4ddbfb496f487b034814bf1a3","https://git.kernel.org/stable/c/cc3e12330599f097f0e1f792435686ddc276f26d"],"weaknesses":[],"ingestedAt":"2026-10-29T20:13:34.582Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/90xxx/CVE-2026-90211.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-90211","state":"PUBLISHED","datePublished":"2026-09-17T16:07:25.454Z","dateUpdated":"2026-10-19T08:59:47.377Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-11T19:38:34.793Z"},"containers":{"cna":{"title":"bpf, s390: Clear fetch destination on faulting arena atomic","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, s390: Clear fetch destination on faulting arena atomic\n\nSame missing register clear as on riscv64. A RMW atomic on an arena pointer\nis converted to BPF_PROBE_ATOMIC and gets an exception table entry, but\nbpf_jit_probe_atomic_pre() only fills in the arena base and the probe\noffset, leaving probe->reg at the -1 that bpf_jit_probe_init() set, which\nbpf_jit_probe_post() writes into the entry and ex_handler_bpf() then reads\nback as \"there is nothing to clear\".\n\nThat is right for a plain BPF_{ADD,AND,OR,XOR}, which only writes memory,\nbut an RMW carrying BPF_FETCH also reads the old value into a register:\nsrc_reg for BPF_{ADD,AND,OR,XOR} | BPF_FETCH and BPF_XCHG, and r0 for\nBPF_CMPXCHG. So on a fault over an unmapped arena page the program resumes\nat the landing pad with whatever that register held before the atomic\ninstead of the 0 that every other BPF_PROBE_* access delivers.\n\nFill probe->reg in from bpf_atomic_load_reg(). Unlike x86-64 and arm64,\ns390x does not report arena violations from its exception handler, so there\nis no access direction to correct here, only the missing register clear."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"2f9469484a3b52c66b799de73bd1ca75617bc8d5","status":"affected","lessThan":"44b702fceb4cf3a4ddbfb496f487b034814bf1a3","versionType":"git"},{"version":"2f9469484a3b52c66b799de73bd1ca75617bc8d5","status":"affected","lessThan":"cc3e12330599f097f0e1f792435686ddc276f26d","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/s390/net/bpf_jit_comp.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.11","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.11","versionType":"semver"},{"version":"7.2.6","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/s390/net/bpf_jit_comp.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/44b702fceb4cf3a4ddbfb496f487b034814bf1a3"},{"url":"https://git.kernel.org/stable/c/cc3e12330599f097f0e1f792435686ddc276f26d"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-19T08:59:47.377Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"7.2.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}