Linux Kernel CVE-2026-90217

Requires local access and the capability to load eBPF programs into the kernel - normally CAP_BPF or CAP_SYS_ADMIN, or a system configured to permit unprivileged BPF (kernel.unprivileged_bpf_disabled=0). The kernel must be built with BPF support and fall within the affected version range (introduced ~6.7, fixed in 7.2.6/7.3-rc1). No user interaction or network access is needed (UI:N, AV:L), and the trigger is a deterministic verifier logic flaw rather than a race, so complexity is low; the primary limiting factor is the BPF-load privilege requirement, which on hardened/default modern configurations is restricted to privileged principals.

This is a Linux kernel eBPF verifier soundness bug: during state pruning the verifier failed to compare the pointer type of STACK_ITER (iterator) stack slots, treating a MEM_RCU slot as equivalent to a PTR_UNTRUSTED slot. That lets the verifier prune a genuinely unsafe execution path, so a crafted BPF program can smuggle an untrusted pointer past verification - the classic precursor to arbitrary kernel memory read/write and local privilege escalation, which justifies the vendor's C:H/I:H/A:H. The CVSS vector (AV:L/AC:L/PR:L/UI:N) is internally consistent with a deterministic (not race-based) logic flaw reachable by a local principal able to load BPF programs. Weighing all signals: no EPSS score, no CISA KEV entry, and no public POC are supplied, so there is no evidence of active or automated exploitation. SSVC inputs (exploitation status, automatable) are not provided. Net: a high-CVSS bug with real LPE potential and a reliable (non-race) trigger, but current real-world urgency is tempered by the absence of any exploitation or POC signal and by the gating requirement of BPF-load capability. Note the 'Information Disclosure' tag understates the flaw - a verifier bug of this class enables integrity/availability impact (memory corruption), not merely disclosure.

A local user with the ability to load eBPF programs (typically CAP_BPF/CAP_SYS_ADMIN, or via unprivileged BPF where enabled) writes a program that exploits two iterator states the verifier now wrongly considers equal, causing an unsafe branch to be pruned and accepted. The verified program then dereferences an untrusted pointer as if trusted, giving controlled kernel memory access that can be escalated to root. No public exploit code is identified at time of analysis, and exploitation is local with low complexity but requires BPF-load privileges.