CVE-2026-92520: bpf: Zero queue and stack outputs on lock failure

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Zero queue and stack outputs on lock failure Queue and stack pop/peek helpers accept an uninitialized output buffer because the verifier expects the helper to initialize it. The empty-map error path clears the buffer, but a failed lock acquisition returns -EBUSY without writing it. Clear the output before returning -EBUSY so BPF programs cannot observe uninitialized stack contents after a failed helper call.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 to < a6090eeb289c5fa45f7b629befac2bd3c19a6daeaffected
a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 to < 23b4bcc79bab5285275912b94e98c286f281de75affected
a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 to < 1534c4bff3aaca19c4c9a82f93e9b81f7c983de3affected
a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 to < e2396b8a562073787e627a5f483f1bc5c452fa6aaffected
a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 to < 7ac6e1ae41a09f1dd4baeeff1d028ae49ee01232affected
40e34ea01748e5b8afdd40a172868be1e1ab0edeaffected
388c9d3eefaea99828ee5000c693128a5b41ee7caffected
acabf5df49aa3a4f9c96200102d893351b511a88affected
e388671635acf470f0986d874389148fd234620baffected
232f0ba4d69263af5912e279fcc32fef2882b1dcaffected
5.4.258 to < 5.5affected
5.10.198 to < 5.11affected
5.15.134 to < 5.16affected
6.1.56 to < 6.2affected
6.5.6 to < 6.6affected

Linux Linux

Default version status: affected

6.6affected
0 to < 6.6unaffected
6.6.160 to ≤ 6.6.*unaffected
6.12.114 to ≤ 6.12.*unaffected
6.18.52 to ≤ 6.18.*unaffected
7.2.6 to ≤ 7.2.*unaffected
7.3 to ≤ *unaffected

CVE-2026-92520

bpf: Zero queue and stack outputs on lock failure

Description

Affected products

Linux Linux

Linux Linux

References