CVE-2026-90211

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the BPF subsystem on s390 architecture where a Read-Modify-Write (RMW) atomic operation on an arena pointer fails to clear the destination register during a fault over an unmapped arena page. When an RMW operation carrying BPF FETCH occurs, the system should read the old value into a register—specifically src reg for BPF {ADD,AND,OR,XOR} | BPF FETCH and BPF XCHG, or r0 for BPF CMPXCHG. However, because bpf jit probe atomic pre() does not properly fill probe->reg, the ex handler bpf() function fails to clear the register. Consequently, the program resumes at the landing pad with the previous register value instead of the expected 0. This is addressed by filling probe->reg using the bpf atomic load reg() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.