« Volver al listado

CVE-2026-90143

Estado: RecibidaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

net: kcm: Hold RCU read lock while running BPF parser

kcm_parse_func_strparser() calls bpf_prog_run_pin_on_cpu() which prevents CPU migration, but does not establish an RCU read-side critical section. Consequently, BPF map operations can trigger WARN_ON_ONCE(!bpf_rcu_lock_held()) when called from the KCM strparser program.

Hold the RCU read lock while running the program.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad local en kernel Linux con permisos requeridos (PR:L). Explotación mediante BPF puede permitir ejecución de código arbitrario o DoS. T1068 por escalada de privilegios local; T1059.004 por ejecución en kernel; T1499.004 por potential DoS.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution PreventionThreat Intelligence ProgramFilter Network TrafficApplication Isolation and SandboxingExploit ProtectionUpdate Software

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-90143",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "9b73896a81dc68a638a011877b7344b252f92276",
              "lessThan": "37108861cf7bd909d4a372069bcd61c8f489e232",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9b73896a81dc68a638a011877b7344b252f92276",
              "lessThan": "3c70d27e792a28bca650ddd8a9aa0fe3591ffec5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9b73896a81dc68a638a011877b7344b252f92276",
              "lessThan": "1d26a6e007d46babc7fa76e5a157dccf86cd55c0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9b73896a81dc68a638a011877b7344b252f92276",
              "lessThan": "b0e94ea63dbdcbfec9beb819cd5f8fa584809ef2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9b73896a81dc68a638a011877b7344b252f92276",
              "lessThan": "21526f8a191a3c50622b8c10bd927870d780eae4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9b73896a81dc68a638a011877b7344b252f92276",
              "lessThan": "292846223eaddba890e40699d2ab82ee5671798c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9b73896a81dc68a638a011877b7344b252f92276",
              "lessThan": "f392affef3c9ce64dfdde794df0579e0a7793440",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9b73896a81dc68a638a011877b7344b252f92276",
              "lessThan": "b0346dd64e4905291cc9c479f2e6cf1884ced4e6",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/kcm/kcmsock.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.9",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/kcm/kcmsock.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:17:07.097",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1d26a6e007d46babc7fa76e5a157dccf86cd55c0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/21526f8a191a3c50622b8c10bd927870d780eae4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/292846223eaddba890e40699d2ab82ee5671798c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/37108861cf7bd909d4a372069bcd61c8f489e232",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3c70d27e792a28bca650ddd8a9aa0fe3591ffec5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b0346dd64e4905291cc9c479f2e6cf1884ced4e6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b0e94ea63dbdcbfec9beb819cd5f8fa584809ef2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f392affef3c9ce64dfdde794df0579e0a7793440",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: kcm: Hold RCU read lock while running BPF parser\n\nkcm_parse_func_strparser() calls bpf_prog_run_pin_on_cpu() which\nprevents CPU migration, but does not establish an RCU read-side\ncritical section. Consequently, BPF map operations can trigger\nWARN_ON_ONCE(!bpf_rcu_lock_held()) when called from the KCM strparser\nprogram.\n\nHold the RCU read lock while running the program."
    }
  ],
  "lastModified": "2026-09-18T18:17:43.690",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}