{"id":"AZL-102590","summary":"CVE-2026-90157 affecting package kernel 6.6.150.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject negative optlen in cgroup getsockopt hook\n\nA cgroup getsockopt BPF program can shrink ctx-\u003eoptlen after the\nkernel getsockopt handler has run. The kernel-buffer variant, used by\nTCP_ZEROCOPY_RECEIVE, only rejects values larger than the original\nlength.\n\nIf BPF writes a negative optlen, that value is accepted and propagated\nback to the TCP getsockopt code. It can then be passed to\ncopy_to_sockptr() as a size_t and trigger the hardened usercopy\nbytes \u003e INT_MAX warning.\n\nReject negative ctx.optlen in __cgroup_bpf_run_filter_getsockopt_kern(),\nmatching the lower-bound validation already present in the sockptr-based\ngetsockopt hook.","modified":"2026-09-18T14:18:02.852290296Z","published":"2026-09-17T17:17:08Z","upstream":["CVE-2026-90157"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90157"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.150.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-102590.json"}}],"schema_version":"1.9.0"}