Critical Alert 1 Active Exploit Detected Today

CVE-2026-7273 Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability →
Powered by CVE Watchtower
×

CVE Watchtower

← Back to CVE List

CVE-2026-90195NVD

Vulnerability Summary

In the Linux kernel, the following vulnerability has been resolved:

riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args

On RV64, the ABI requires sign-extension for signed 1-byte and 2-byte kfunc
args. However, the RV64 JIT currently does not perform sign-extension for
such kfunc args.

Before commit 7ce090afbf72 ("bpf: Infer zext_dst based on static register
liveness analysis"), state pruning could potentially omit zero-extension
of 32-bit subregisters, which inadvertently masked the above issue by making
the args appear as if they had been properly sign-extended. After that
commit, the problem is exposed, causing the kfunc_call/kfunc_call_test4
selftest to fail.

Fix this by extending the existing sign-extension logic to handle signed
1-byte and 2-byte kfunc args as well.
Severity Level
UNKNOWN
Published Date
Sep 17, 2026
Last Modified
Sep 17, 2026
Exploitation Status
No confirmed exploitation yet
EPSS Score (30-Day)
0.20%Probability
Root Weakness (CWE)
N/A

Affected & Patched Versions

Affected Versions
  • Linux Linux >= 443574b033876c85a35de4c65c14f7fe092222b2 and < 555fc6f1caf00ce7005e732b688da26c0dc3c5c5
  • Linux Linux >= 443574b033876c85a35de4c65c14f7fe092222b2 and < 801ae90f8ce099187e6224cec7d72d07a4df0324
  • Linux Linux >= 443574b033876c85a35de4c65c14f7fe092222b2 and < 71dbd143be598954ae103feadd12692aeb0f2f88
  • Linux Linux >= 443574b033876c85a35de4c65c14f7fe092222b2 and < f2aaa621591093cfe8224a25ef2f04a3b1e304b0
  • Linux Linux >= 6.9
Patched Versions
  • Linux Linux 555fc6f1caf00ce7005e732b688da26c0dc3c5c5
  • Linux Linux 801ae90f8ce099187e6224cec7d72d07a4df0324
  • Linux Linux 71dbd143be598954ae103feadd12692aeb0f2f88
  • Linux Linux f2aaa621591093cfe8224a25ef2f04a3b1e304b0
📧Email Delivery — Threat intel straight to your inbox.
♾️Unlimited Vendors — Track your entire stack.
🚨All New CVEs — Be the first to know.
⚙️Custom EPSS — Filter noise, focus on risk.
💬Webhooks — Slack & Teams integration.
🚫Ad-Free — Uninterrupted experience.
📧Email Delivery — Threat intel straight to your inbox.
♾️Unlimited Vendors — Track your entire stack.
🚨All New CVEs — Be the first to know.
⚙️Custom EPSS — Filter noise, focus on risk.
💬Webhooks — Slack & Teams integration.
🚫Ad-Free — Uninterrupted experience.