CVE-2026-90247 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux systems, especially those using the bpf subsystem or running kernels that have not been patched, should assess exposure and apply patches or mitigations as necessary.

Why it matters

CVE-2026-90247 is a Linux kernel vulnerability in the bpf subsystem that can cause a deadlock due to a missed unlock in the irq_work path. Linux kernel developers, maintainers, and users should assess exposure and apply patches or mitigations as necessary.

• Denial of service due to deadlock
• Potential privilege escalation if exploited in conjunction with other vulnerabilities
• Increased risk for systems relying on the bpf subsystem
• Verification of kernel versions and patch application required

Technical summary

The CVE-2026-90247 vulnerability is caused by a missed unlock in the irq_work path of the stack_map_get_build_id_offset function in the Linux kernel's bpf subsystem. This can lead to a deadlock situation. The issue arises from a per-CPU irq_work that defers mmap_read_unlock from NMI context being reused. Affected Linux kernel versions require patches to resolve this issue. Developers and maintainers should assess exposure and apply patches or mitigations as necessary. The vulnerability impacts systems using the bpf subsystem or running unpatched kernels.

Defensive priority

Medium

Recommended defensive actions

• Review and apply patches from Linux vendors for the affected kernel versions.
• Restrict access to sensitive data and systems until patches are applied.
• Monitor system logs for potential exploitation attempts.
• Verify kernel versions and update if necessary.
• Perform a thorough review of system configurations and apply compensating controls if patches cannot be applied immediately.
• Track and inventory assets that may be affected by this vulnerability.
• Implement additional monitoring to detect potential exploitation attempts.

Evidence notes

The CVE record and source item provide details about the vulnerability, including its introduction, impact, and fixed versions. However, some information, such as specific affected versions and potential exploits, is not provided or requires verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.