« Volver al listado

CVE-2026-90342

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix mmap_lock deadlock on arena lock failure

Reported by the Sashiko AI review.

arena_vm_fault() returns VM_FAULT_RETRY when it can't take arena->spinlock, but it never took mmap_lock. The fault path assumes a VM_FAULT_RETRY handler already dropped mmap_lock and re-takes it on the retry, so mmap_lock gets taken twice and can deadlock:

Return VM_FAULT_SIGBUS instead, for two reasons:

So returning VM_FAULT_RETRY here is overkill.

Detalles técnicos trazas, registros y código del informe original
	do_user_addr_fault()
	{
		fault = handle_mm_fault(...);   // calls arena_vm_fault()
		if (fault & VM_FAULT_RETRY)
			goto retry;   // re-locks mmap_lock
		mmap_read_unlock(mm);
	}

1. We could keep VM_FAULT_RETRY, but then we'd have to drop the fault
   lock first and cap the retry ourselves, the way __folio_lock_or_retry()
   does.

2. A failed raw_res_spin_lock_irqsave() already means a possible deadlock
   was detected, so retrying just hits the same lock again.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-90342",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "b8467290edab4bafae352bf3f317055669a1a458",
              "lessThan": "af8087f16714f7620c4db3e732baaa1b2337948f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b8467290edab4bafae352bf3f317055669a1a458",
              "lessThan": "0b10b945479c954393d62ee3229d2f224a4ca91c",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "kernel/bpf/arena.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "7.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "kernel/bpf/arena.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:17:32.877",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0b10b945479c954393d62ee3229d2f224a4ca91c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/af8087f16714f7620c4db3e732baaa1b2337948f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix mmap_lock deadlock on arena lock failure\n\nReported by the Sashiko AI review.\n\narena_vm_fault() returns VM_FAULT_RETRY when it can't take\narena->spinlock, but it never took mmap_lock. The fault path assumes a\nVM_FAULT_RETRY handler already dropped mmap_lock and re-takes it on the\nretry, so mmap_lock gets taken twice and can deadlock:\n\n\tdo_user_addr_fault()\n\t{\n\t\tfault = handle_mm_fault(...);   // calls arena_vm_fault()\n\t\tif (fault & VM_FAULT_RETRY)\n\t\t\tgoto retry;   // re-locks mmap_lock\n\t\tmmap_read_unlock(mm);\n\t}\n\nReturn VM_FAULT_SIGBUS instead, for two reasons:\n\n1. We could keep VM_FAULT_RETRY, but then we'd have to drop the fault\n   lock first and cap the retry ourselves, the way __folio_lock_or_retry()\n   does.\n\n2. A failed raw_res_spin_lock_irqsave() already means a possible deadlock\n   was detected, so retrying just hits the same lock again.\n\nSo returning VM_FAULT_RETRY here is overkill."
    }
  ],
  "lastModified": "2026-09-17T17:17:32.877",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}