CVE-2026-92520: bpf: Zero queue and stack outputs on lock failure

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-17 · updated 2026-10-30

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Zero queue and stack outputs on lock failure Queue and stack pop/peek helpers accept an uninitialized output buffer because the verifier expects the helper to initialize it. The empty-map error path clears the buffer, but a failed lock acquisition returns -EBUSY without writing it. Clear the output before returning -EBUSY so BPF programs cannot observe uninitialized stack contents after a failed helper call.

Affected products

Linux: from 6.1.56 before 6.1.191; from 5.4.258 before 5.5; from 5.10.198 before 5.11; from 5.15.134 before 5.16; from 6.5.6 before 6.6 — fixed in 6.1.191, 5.5, 5.11, 5.16, 6.6

How to fix

Upgrade to a fixed version: Linux 6.1.191, 5.5, 5.11, 5.16. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-92520 or the next vulnerability affects your stack