CVE-2026-90143 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems should assess exposure and apply the patch or mitigation measures as needed. They should verify Linux kernel patch application to prevent WARN_ON_ONCE(!bpf_rcu_lock_held()) errors and monitor system logs for errors related to BPF map operations. Additionally, they should review compensating controls for exposed systems while remediation is scheduled and

Why it matters

A Linux kernel vulnerability can cause WARN_ON_ONCE(!bpf_rcu_lock_held()) errors when BPF map operations are called from the KCM strparser program. Linux kernel developers, maintainers, and users should assess exposure and apply the patch or mitigation measures as needed.

• Verify Linux kernel patch application to prevent WARN_ON_ONCE(!bpf_rcu_lock_held()) errors.
• Assess Linux kernel version and configuration to ensure patch applicability.
• Monitor system logs for errors related to BPF map operations.

Technical summary

The Linux kernel's kcm_parse_func_strparser() function has a vulnerability that can trigger WARN_ON_ONCE(!bpf_rcu_lock_held()) errors when BPF map operations are called from the KCM strparser program. The fix involves holding the RCU read lock while running the BPF parser. This vulnerability affects Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems. The technical impact is medium, and the fix requires patching the Linux kernel to establish an RCU read-side critical section.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the Linux kernel patch to hold the RCU read lock while running the BPF parser.
• Verify the Linux kernel version and configuration to ensure the patch is applied correctly.
• Monitor system logs for WARN_ON_ONCE(!bpf_rcu_lock_held()) errors.
• Assess Linux kernel version and configuration to ensure patch applicability.
• Verify Linux kernel patch application to prevent WARN_ON_ONCE(!bpf_rcu_lock_held()) errors.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD vulnerability detail page provide information about the vulnerability. The Linux kernel patch notes and Git commit hashes are also available. To verify, defenders should check the Linux kernel version and configuration to ensure the patch is applied correctly and monitor system logs for WARN_ON_ONCE(!bpf_rcu_lock_held()) errors. Additionally, they should assess exposure and apply the patch or mitigation measures as needed. Evidence is limited to public sources and may not reflect all affected systems or specific

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.