Linux Kernel CVE-2026-90177

Requires local access plus the ability to load eBPF programs - practically CAP_BPF/CAP_SYS_ADMIN, or unprivileged BPF explicitly enabled via kernel.unprivileged_bpf_disabled=0, which is NOT the default on most modern distributions. The kernel must be roughly 6.10 or later with BPF arena/atomic RMW support. The attacker must construct a program where two verifier paths reach the same atomic RMW instruction with differing destination pointer types (one PTR_TO_ARENA, one ordinary pointer) to bypass the type check that only fires on the arena path. Limiting factors: no network vector (AV:L), no remote exploitation, default BPF hardening on hardened distros raises the privilege requirement, and success depends on the specific dual-path program construction.

This is a Linux kernel eBPF verifier soundness bug where atomic read-modify-write (RMW) verification records an instruction's pointer type only when the destination is PTR_TO_ARENA, so a second verification path can reach the same instruction with an ordinary pointer without being checked against the saved arena type; the post-verification fixup then rewrites that instruction to BPF_PROBE_ATOMIC for every path based on the saved type, producing a type-confusion/memory-safety mismatch. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8) is consistent with a local privilege-escalation-class verifier flaw. No EPSS score, no CISA KEV listing, and no public POC were provided, so despite the high base score this is not a confirmed real-world exploitation priority - it reads as a defense-in-depth verifier hardening fix rather than an actively weaponized issue. One caveat to verify with the vendor: PR:L assumes the attacker can load eBPF programs, but on most modern distributions unprivileged BPF is disabled by default (kernel.unprivileged_bpf_disabled), which effectively raises the bar to CAP_BPF/CAP_SYS_ADMIN and would push privileges toward PR:H. CWE is N/A in the input; this is functionally a type-confusion/memory-corruption class (CWE-843/CWE-119), not the 'Information Disclosure' the tag implies.

A local user with the ability to load eBPF programs crafts a program in which two verification branches converge on the same atomic RMW instruction using different destination pointer types (one PTR_TO_ARENA, one ordinary pointer). The verifier fails to compare the second path against the saved type, and the post-verification fixup rewrites the instruction to BPF_PROBE_ATOMIC for all paths, yielding a type-confused kernel memory access that can be leveraged toward memory corruption and local privilege escalation. No public exploit code was identified at time of analysis.