CVE-2026-92520 - Vulnerability Details

- bpf: Zero queue and stack outputs on lock failure

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Zero queue and stack outputs on lock failure

Queue and stack pop/peek helpers accept an uninitialized output buffer
because the verifier expects the helper to initialize it. The empty-map
error path clears the buffer, but a failed lock acquisition returns
-EBUSY without writing it.

Clear the output before returning -EBUSY so BPF programs cannot observe
uninitialized stack contents after a failed helper call.

Published: 2026-09-17

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8`	affected	< 1534c4bff3aaca19c4c9a82f93e9b81f7c983de3
`a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8`	affected	< e2396b8a562073787e627a5f483f1bc5c452fa6a
`a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8`	affected	< 7ac6e1ae41a09f1dd4baeeff1d028ae49ee01232
`40e34ea01748e5b8afdd40a172868be1e1ab0ede`	affected	—
`388c9d3eefaea99828ee5000c693128a5b41ee7c`	affected	—
`acabf5df49aa3a4f9c96200102d893351b511a88`	affected	—
`e388671635acf470f0986d874389148fd234620b`	affected	—
`232f0ba4d69263af5912e279fcc32fef2882b1dc`	affected	—
`5.4.258`	affected	< 5.5
`5.10.198`	affected	< 5.11
`5.15.134`	affected	< 5.16
`6.1.56`	affected	< 6.2
`6.5.6`	affected	< 6.6

Linux

affected

Version	Status	Constraints
`6.6`	affected	—
`0`	unaffected	< 6.6
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8,1534c4bff3aaca19c4c9a82f93e9b81f7c983de3)`	affected	code_commit	—
`[a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8,e2396b8a562073787e627a5f483f1bc5c452fa6a)`	affected	code_commit	—
`[a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8,7ac6e1ae41a09f1dd4baeeff1d028ae49ee01232)`	affected	code_commit	—
`40e34ea01748e5b8afdd40a172868be1e1ab0ede`	affected	code_commit	—
`388c9d3eefaea99828ee5000c693128a5b41ee7c`	affected	code_commit	—
`acabf5df49aa3a4f9c96200102d893351b511a88`	affected	code_commit	—
`e388671635acf470f0986d874389148fd234620b`	affected	code_commit	—
`232f0ba4d69263af5912e279fcc32fef2882b1dc`	affected	code_commit	—
`[5.4.258,5.5)`	affected	semver	—
`[5.10.198,5.11)`	affected	semver	—
`[5.15.134,5.16)`	affected	semver	—
`[6.1.56,6.2)`	affected	semver	—
`[6.5.6,6.6)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.6`	affected	generic	—
`[0,6.6)`	unaffected	semver	—
`[6.18.52,6.19.0)`	unaffected	semver	—
`[7.2.6,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00166.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1534c4bff3aaca19c4c9a82f93e9b81f7c983de3
https://git.kernel.org/stable/c/7ac6e1ae41a09f1dd4baeeff1d028ae49ee01232
https://git.kernel.org/stable/c/e2396b8a562073787e627a5f483f1bc5c452fa6a

History

Sat, 19 Sep 2026 13:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-200 CWE-788

Thu, 17 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: bpf: Zero queue and stack outputs on lock failure Queue and stack pop/peek helpers accept an uninitialized output buffer because the verifier expects the helper to initialize it. The empty-map error path clears the buffer, but a failed lock acquisition returns -EBUSY without writing it. Clear the output before returning -EBUSY so BPF programs cannot observe uninitialized stack contents after a failed helper call.
Title		bpf: Zero queue and stack outputs on lock failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1534c4bff3aaca19c4c9a82f93e9b81f7c983de3 https://git.kernel.org/stable/c/7ac6e1ae41a09f1dd4baeeff1d028ae49ee01232 https://git.kernel.org/stable/c/e2396b8a562073787e627a5f483f1bc5c452fa6a

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-17T16:10:27.447Z

Updated: 2026-09-17T16:10:27.447Z

Reserved: 2026-09-16T12:21:13.874Z

Link: CVE-2026-92520

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-17T17:17:54.900

Modified: 2026-09-17T17:17:54.900

Link: CVE-2026-92520

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-19T12:45:16Z

Weaknesses

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CWE-788
Access of Memory Location After End of Buffer

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object