Critical Stack Overflow Vulnerability in Linux Kernel - CVE-2026-90358
Summary
DEBIAN-CVE-2026-90358: In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix trampoline stack size for 128-bit arguments btf_distill_func_proto() accepts a function argument up to 16 bytes, so a 128-bit scalar such... Affects linux versions 6.1.106-1 – 7.2~rc7-1~exp1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, including Debian. It manages hardware resources and provides essential services for software applications. This vulnerability affects the kernel's handling of function arguments, particularly with 128-bit scalar types, which can lead to stack corruption and potential system instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified where the handling of 128-bit arguments in the BPF (Berkeley Packet Filter) trampoline mechanism is flawed. The function btf_distill_func_proto() accepts function arguments up to 16 bytes, but the current implementation incorrectly assumes that an __int128 argument only requires one register. This miscalculation leads to an under-allocation of the register save area, causing the save_args() function to overwrite adjacent stack slots. This can result in unpredictable behavior, including crashes or security breaches, as adjacent memory may contain sensitive data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
The CVE-2026-90358 vulnerability in the Linux kernel poses significant risks due to improper handling of 128-bit function arguments. Users are advised to update their systems promptly to mitigate potential impacts. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2026-90358 is a vulnerability in the Linux kernel that affects the handling of 128-bit function arguments, potentially leading to stack corruption.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The risks include system crashes, unpredictable behavior, and potential security breaches due to overwritten memory areas.
Yes, a patch is expected to be released. Users should update their Linux kernel to the latest version to mitigate this vulnerability.
While there are no specific workarounds, it is crucial to monitor your system for any unusual behavior and plan to apply the patch as soon as it is available.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
