OCTOBER 12, 2026
Live Feed
Back to database
Case File

CVE-2026-90143

HIGH · CVSS 7.8 EPSS 0.18%

Source: NVD + CISA KEV + EPSS · Published 2026-09-17 · Last synced 2026-10-12

CyberRota Analysis

AI-Generated

The vulnerability affects the Linux kernel's KCM (Kernel Connection Multiplexer) component, specifically in the handling of BPF (Berkeley Packet Filter) programs where the RCU (Read-Copy-Update) read lock is not held during execution. This oversight can lead to potential instability, as BPF map operations may trigger warnings and could result in undefined behavior. System administrators and developers using affected Linux kernel versions should prioritize addressing this issue to ensure system reliability and prevent potential exploitation.

CVE
CVE-2026-90143
Severity
HIGH
CVSS
7.8
EPSS
0.18%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: net: kcm: Hold RCU read lock while running BPF parser kcm_parse_func_strparser() calls bpf_prog_run_pin_on_cpu() which prevents CPU migration, but does not establish an RCU read-side critical section. Consequently, BPF map operations can trigger WARN_ON_ONCE(!bpf_rcu_lock_held()) when called from the KCM strparser program. Hold the RCU read lock while running the program.