CVE-2026-90358

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the BPF subsystem on x86 architectures where the trampoline stack size is incorrectly calculated for 128-bit arguments. The btf distill func proto() function accepts arguments up to 16 bytes, meaning a 128-bit scalar like int128 is processed with an arg size of 16. However, the implementation incorrectly assumes a 128-bit argument requires only one register, leading to an under-allocation of the register save area. Consequently, the save args() function overwrites adjacent stack slots.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.