---
id: CVE-2026-90211
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf, s390: Clear fetch destination on faulting arena atomic

  Same missing register clear as on riscv64
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf, s390: Clear fetch destination on faulting arena atomic

  Same missing register clear as on riscv64. A RMW atomic on an arena pointer
  is converted to BPF_PROBE_ATOMI…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 2f9469484a3b52c66b799de73bd1ca75617bc8d5 <
    1a26541b3f60ce447433a4c4dd56edb10d2cd580
  - >-
    Linux >= 2f9469484a3b52c66b799de73bd1ca75617bc8d5 <
    44b702fceb4cf3a4ddbfb496f487b034814bf1a3
  - >-
    Linux >= 2f9469484a3b52c66b799de73bd1ca75617bc8d5 <
    cc3e12330599f097f0e1f792435686ddc276f26d
  - Linux 6.11
published: '2026-09-17'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T14:17:28.800'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90211'
references:
  - url: 'https://git.kernel.org/stable/c/44b702fceb4cf3a4ddbfb496f487b034814bf1a3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cc3e12330599f097f0e1f792435686ddc276f26d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/1a26541b3f60ce447433a4c4dd56edb10d2cd580'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00189
epssPercentile: 0.08849
ingestedAt: '2026-09-17T16:21:47.858Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf, s390: Clear fetch destination on faulting arena atomic

Same missing register clear as on riscv64. A RMW atomic on an arena pointer
is converted to BPF_PROBE_ATOMIC and gets an exception table entry, but
bpf_jit_probe_atomic_pre() only fills in the arena base and the probe
offset, leaving probe->reg at the -1 that bpf_jit_probe_init() set, which
bpf_jit_probe_post() writes into the entry and ex_handler_bpf() then reads
back as "there is nothing to clear".

That is right for a plain BPF_{ADD,AND,OR,XOR}, which only writes memory,
but an RMW carrying BPF_FETCH also reads the old value into a register:
src_reg for BPF_{ADD,AND,OR,XOR} | BPF_FETCH and BPF_XCHG, and r0 for
BPF_CMPXCHG. So on a fault over an unmapped arena page the program resumes
at the landing pad with whatever that register held before the atomic
instead of the 0 that every other BPF_PROBE_* access delivers.

Fill probe->reg in from bpf_atomic_load_reg(). Unlike x86-64 and arm64,
s390x does not report arena violations from its exception handler, so there
is no access direction to correct here, only the missing register clear.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.