---
id: CVE-2026-90159
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks

  _bpf_setsockopt() and _bpf_getsockopt() call sock_owned_by_me() for
  full sockets, so these helpers expe…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks

  _bpf_setsockopt() and _bpf_getsockopt() call sock_owned_by_me() for
  full sockets, so these helpers expe…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 859051dd165ec6cc915f0f2114699021144fd249 <
    61769b9c882a964af3a6ebd9a8e43615f8713234
  - >-
    Linux >= 859051dd165ec6cc915f0f2114699021144fd249 <
    fe91c3f64a738dd97e8542ad5bdfbe5ac430edf6
  - >-
    Linux >= 859051dd165ec6cc915f0f2114699021144fd249 <
    daeb74f5f398e847d1d42906aec6610406a34fdc
  - >-
    Linux >= 859051dd165ec6cc915f0f2114699021144fd249 <
    84473a7e1813a2da7b759ab1d098a84998c8d3f5
  - Linux 6.7
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:09.080'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90159'
references:
  - url: 'https://git.kernel.org/stable/c/61769b9c882a964af3a6ebd9a8e43615f8713234'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/84473a7e1813a2da7b759ab1d098a84998c8d3f5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/daeb74f5f398e847d1d42906aec6610406a34fdc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fe91c3f64a738dd97e8542ad5bdfbe5ac430edf6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.873Z'
epss: 0.00209
epssPercentile: 0.09811
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks

_bpf_setsockopt() and _bpf_getsockopt() call sock_owned_by_me() for
full sockets, so these helpers expect the socket lock to be held.

BPF_CGROUP_UNIX_GETPEERNAME and BPF_CGROUP_UNIX_GETSOCKNAME run BPF
programs without acquiring the socket lock. A program attached to
either hook can therefore trigger the sock_owned_by_me() warning by
calling bpf_setsockopt() or bpf_getsockopt().

Disallow bpf_setsockopt() and bpf_getsockopt() for CGROUP_UNIX_GETPEERNAME
and CGROUP_UNIX_GETSOCKNAME.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.