CVE-2026-90250

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A null-pointer dereference occurs in the bpf and cgroup components when replacing a program. This happens when an empty program attached to a cgroup is replaced by a new program that utilizes BPF MAP TYPE PERCPU CGROUP STORAGE and calls the bpf get local storage() helper. The issue arises because the cgroup bpf replace() function fails to allocate and assign the necessary cgroup storage for the replacement program, causing it to inherit uninitialized storage and trigger a kernel panic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.