bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks (CVE-2026-90159) | HOL Guard CVE

Unknown severity · Source severity not reportedCVE-2026-90159

bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks

Answer in brief

CVE-2026-90159 records a Unknown severity vulnerability in bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 17, 2026Updated Sep 17, 2026Source checked Sep 17, 2026First seen by HOL Sep 17, 2026Material review Sep 17, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=859051dd165ec6cc915f0f2114699021144fd249 <61769b9c882a964af3a6ebd9a8e43615f8713234 \|\| >=859051dd165ec6cc915f0f2114699021144fd249 <fe91c3f64a738dd97e8542ad5bdfbe5ac430edf6 \|\| >=859051dd165ec6cc915f0f2114699021144fd249 <daeb74f5f398e847d1d42906aec6610406a34fdc \|\| >=859051dd165ec6cc915f0f2114699021144fd249 <84473a7e1813a2da7b759ab1d098a84998c8d3f5	61769b9c882a964af3a6ebd9a8e43615f8713234, fe91c3f64a738dd97e8542ad5bdfbe5ac430edf6, daeb74f5f398e847d1d42906aec6610406a34fdc, 84473a7e1813a2da7b759ab1d098a84998c8d3f5
Linux/Linuxgeneric	6.7	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to 61769b9c882a964af3a6ebd9a8e43615f8713234 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 17, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 17, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 17, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks _bpf_setsockopt() and _bpf_getsockopt() call sock_owned_by_me() for full sockets, so these helpers expect the socket lock to be held. BPF_CGROUP_UNIX_GETPEERNAME and BPF_CGROUP_UNIX_GETSOCKNAME run BPF programs without acquiring the socket lock. A program attached to either hook can therefore trigger the sock_owned_by_me() warning by calling bpf_setsockopt() or bpf_getsockopt(). Disallow bpf_setsockopt() and bpf_getsockopt() for CGROUP_UNIX_GETPEERNAME and CGROUP_UNIX_GETSOCKNAME.

Quoted source text, attributed separately from HOL analysis.