CVE-2026-90157

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the cgroup getsockopt BPF program where the ctx->optlen can be shrunk after the kernel getsockopt handler has executed. In the kernel-buffer variant used by TCP ZEROCOPY RECEIVE, only values larger than the original length are rejected. If a BPF program writes a negative optlen, the value is accepted and passed to the TCP getsockopt code, which then passes it to the copy to sockptr() function as a size t. This can trigger a hardened usercopy warning when bytes exceed INT MAX.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.