High 7.8Published Sep 17, 2026

CVE-2026-90217bpf: Compare iterator types during state pruning

Updated under an hour ago (Oct 26, 2026, 11:20 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: bpf: Compare iterator types during state pruning An iterator stack slot can be MEM_RCU or PTR_UNTRUSTED. These states must not be equal, or the verifier can prune an unsafe path. Compare the pointer type for STACK_ITER slots.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from dfab99df147b0d364f0c199f832ff2aedfb2265a before 86bbaf9e6e4fa6c0dfb352e9e11fae328069233a; from dfab99df147b0d364f0c199f832ff2aedfb2265a before e4ab436d5ba61e4910fd49d24bb64ddb34d493d6; from dfab99df147b0d364f0c199f832ff2aedfb2265a before 6424b9cde9edc7f2098115bbfd1ee3d84a958380; from dfab99df147b0d364f0c199f832ff2aedfb2265a before 83608e303b95d07afba1c15da0b5d9e513c2f15a	CNA record

References

References

https://git.kernel.org/stable/c/86bbaf9e6e4fa6c0dfb352e9e11fae328069233a
https://git.kernel.org/stable/c/e4ab436d5ba61e4910fd49d24bb64ddb34d493d6
https://git.kernel.org/stable/c/6424b9cde9edc7f2098115bbfd1ee3d84a958380
https://git.kernel.org/stable/c/83608e303b95d07afba1c15da0b5d9e513c2f15a

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.