CVE-2026-92520 bpf: Zero queue and stack outputs on lock failure
A local attacker with BPF privileges can read uninitialized kernel stack memory via failed queue or stack helper calls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-92520?
CVE-2026-92520 is a vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Zero queue and stack outputs on lock failure
Queue and stack pop/peek helpers accept an uninitialized output buffer because the verifier expects the helper to initialize it. The empty-map error path clears the buffer, but a failed lock acquisition returns -EBUSY without writing it.
Clear the output before returning -EBUSY so BPF programs cannot observe uninitialized stack contents after a failed helper call.
Which versions are affected by CVE-2026-92520?
How do I fix CVE-2026-92520?
Apply the vendor's patch.
Is CVE-2026-92520 being exploited?
There is no known exploitation of CVE-2026-92520 in the wild and no public exploit code.
Sources
Also known as AZL-102966, BELL-CVE-2026-92520, DEBIAN-CVE-2026-92520, GHSA-fc4c-4457-gw27, UBUNTU-CVE-2026-92520.