Answer in brief
CVE-2026-90143 records a Unknown severity vulnerability in net: kcm: Hold RCU read lock while running BPF parser. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=9b73896a81dc68a638a011877b7344b252f92276 <37108861cf7bd909d4a372069bcd61c8f489e232 || >=9b73896a81dc68a638a011877b7344b252f92276 <3c70d27e792a28bca650ddd8a9aa0fe3591ffec5 || >=9b73896a81dc68a638a011877b7344b252f92276 <1d26a6e007d46babc7fa76e5a157dccf86cd55c0 || >=9b73896a81dc68a638a011877b7344b252f92276 <b0e94ea63dbdcbfec9beb819cd5f8fa584809ef2 || >=9b73896a81dc68a638a011877b7344b252f92276 <21526f8a191a3c50622b8c10bd927870d780eae4 || >=9b73896a81dc68a638a011877b7344b252f92276 <292846223eaddba890e40699d2ab82ee5671798c || >=9b73896a81dc68a638a011877b7344b252f92276 <f392affef3c9ce64dfdde794df0579e0a7793440 || >=9b73896a81dc68a638a011877b7344b252f92276 <b0346dd64e4905291cc9c479f2e6cf1884ced4e6 | 37108861cf7bd909d4a372069bcd61c8f489e232, 3c70d27e792a28bca650ddd8a9aa0fe3591ffec5, 1d26a6e007d46babc7fa76e5a157dccf86cd55c0, b0e94ea63dbdcbfec9beb819cd5f8fa584809ef2, 21526f8a191a3c50622b8c10bd927870d780eae4, 292846223eaddba890e40699d2ab82ee5671798c, f392affef3c9ce64dfdde794df0579e0a7793440, b0346dd64e4905291cc9c479f2e6cf1884ced4e6 |
| Linux/Linuxgeneric | 4.9 | Not reported |
Published upstream
Sep 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 17, 2026
In the Linux kernel, the following vulnerability has been resolved: net: kcm: Hold RCU read lock while running BPF parser kcm_parse_func_strparser() calls bpf_prog_run_pin_on_cpu() which prevents CPU migration, but does not establish an RCU read-side critical section. Consequently, BPF map operations can trigger WARN_ON_ONCE(!bpf_rcu_lock_held()) when called from the KCM strparser program. Hold the RCU read lock while running the program.
Quoted source text, attributed separately from HOL analysis.