CVE-2026-90300: Linux

EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: bpf: Clear buf on error in __bpf_get_task_stack Both bpf_get_task_stack and bpf_get_task_stack_sleepable helpers that use __bpf_get_task_stack have buf defined as ARG_PTR_TO_UNINIT_MEM argument and we should initialize the buf on every return path. Adding missing buf memset for __bpf_get_task_stack fail paths. This provides deterministic buffer contents, which is useful when the buffer is used directly as a map key.

Affected products

• Linux Linux: from 5.10.30, before 5.11 (fixed in 5.11); from 5.11.14, before 5.12 (fixed in 5.12); from 5.10.96, before 5.11 (fixed in 5.11); from 5.12, before 7.2.6 (fixed in 7.2.6)

Published 2026-09-17. Last modified 2026-09-17.