CVE-2026-90195

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args On RV64, the ABI requires sign-extension for signed 1-byte and 2-byte kfunc args. However, the RV64 JIT currently does not perform sign-extension for such kfunc args. Before commit 7ce090afbf72 ("bpf: Infer zext_dst based on static register liveness analysis"), state pruning could potentially omit zero-extension of 32-bit subregisters, which inadvertently masked the above issue by making the args appear as if they had been properly sign-extended. After that commit, the problem is exposed, causing the kfunc_call/kfunc_call_test4 selftest to fail. Fix this by extending the existing sign-extension logic to handle signed 1-byte and 2-byte kfunc args as well.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/555fc6f1caf00ce7005e732b688da26c0dc3c5c5
https://git.kernel.org/stable/c/71dbd143be598954ae103feadd12692aeb0f2f88
https://git.kernel.org/stable/c/801ae90f8ce099187e6224cec7d72d07a4df0324
https://git.kernel.org/stable/c/f2aaa621591093cfe8224a25ef2f04a3b1e304b0

Configurations

No configuration.

History

17 Sep 2026, 17:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-17 17:17

Updated : 2026-09-17 17:17

NVD link : CVE-2026-90195

Mitre link : CVE-2026-90195

CVE.ORG link : CVE-2026-90195

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-90195", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "443574b033876c85a35de4c65c14f7fe092222b2", "lessThan": "555fc6f1caf00ce7005e732b688da26c0dc3c5c5", "versionType": "git"}, {"status": "affected", "version": "443574b033876c85a35de4c65c14f7fe092222b2", "lessThan": "801ae90f8ce099187e6224cec7d72d07a4df0324", "versionType": "git"}, {"status": "affected", "version": "443574b033876c85a35de4c65c14f7fe092222b2", "lessThan": "71dbd143be598954ae103feadd12692aeb0f2f88", "versionType": "git"}, {"status": "affected", "version": "443574b033876c85a35de4c65c14f7fe092222b2", "lessThan": "f2aaa621591093cfe8224a25ef2f04a3b1e304b0", "versionType": "git"}], "programFiles": ["arch/riscv/net/bpf_jit_comp64.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"status": "unaffected", "version": "0", "lessThan": "6.9", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.110", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.52", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.2.6", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/riscv/net/bpf_jit_comp64.c"], "defaultStatus": "affected"}]}], "published": "2026-09-17T17:17:14.280", "references": [{"url": "https://git.kernel.org/stable/c/555fc6f1caf00ce7005e732b688da26c0dc3c5c5", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/71dbd143be598954ae103feadd12692aeb0f2f88", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/801ae90f8ce099187e6224cec7d72d07a4df0324", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f2aaa621591093cfe8224a25ef2f04a3b1e304b0", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args\n\nOn RV64, the ABI requires sign-extension for signed 1-byte and 2-byte kfunc\nargs. However, the RV64 JIT currently does not perform sign-extension for\nsuch kfunc args.\n\nBefore commit 7ce090afbf72 (\"bpf: Infer zext_dst based on static register\nliveness analysis\"), state pruning could potentially omit zero-extension\nof 32-bit subregisters, which inadvertently masked the above issue by making\nthe args appear as if they had been properly sign-extended. After that\ncommit, the problem is exposed, causing the kfunc_call/kfunc_call_test4\nselftest to fail.\n\nFix this by extending the existing sign-extension logic to handle signed\n1-byte and 2-byte kfunc args as well."}], "lastModified": "2026-09-17T17:17:14.280", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}