FKIE_CVE-2026-90306

Vulnerability from fkie_nvd - Published: 2026-09-17 17:17 - Updated: 2026-09-21 14:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: ARM: 9481/2: breakpoint: CFI breakpoints only on demand This removes the stub hw_breakpoint_cfi_handler() from ARM, making it not steal breakpoint type 0x03 (ARM_ENTRY_CFI_BREAKPOINT) unless CFI is actively used in the kernel. When not instrumenting with CFI, or when a breakpoint is issued in userspace, we fall through to return 1 from hw_breakpoint_pending() "unhandled fault" so userspace can make use of this breakpoint. Tested with LKDTM and this command line: echo CFI_FORWARD_PROTO > /sys/kernel/debug/provoke-crash/DIRECT still works as expected.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/314f1a6762b5d51b37784ed7dc701d4c3d893703
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8ed9bff906cf8036531d1559f10e82733a52b41f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/da64b150e4b7bee615b33ab21f3137c31ec36922
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm/kernel/hw_breakpoint.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "314f1a6762b5d51b37784ed7dc701d4c3d893703",
              "status": "affected",
              "version": "c3f89986fde7bb9ccc86a901bf28e1f7d69fc3b3",
              "versionType": "git"
            },
            {
              "lessThan": "da64b150e4b7bee615b33ab21f3137c31ec36922",
              "status": "affected",
              "version": "c3f89986fde7bb9ccc86a901bf28e1f7d69fc3b3",
              "versionType": "git"
            },
            {
              "lessThan": "8ed9bff906cf8036531d1559f10e82733a52b41f",
              "status": "affected",
              "version": "c3f89986fde7bb9ccc86a901bf28e1f7d69fc3b3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm/kernel/hw_breakpoint.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: 9481/2: breakpoint: CFI breakpoints only on demand\n\nThis removes the stub hw_breakpoint_cfi_handler() from ARM, making\nit not steal breakpoint type 0x03 (ARM_ENTRY_CFI_BREAKPOINT) unless\nCFI is actively used in the kernel.\n\nWhen not instrumenting with CFI, or when a breakpoint is issued in\nuserspace, we fall through to return 1 from hw_breakpoint_pending()\n\"unhandled fault\" so userspace can make use of this breakpoint.\n\nTested with LKDTM and this command line:\necho CFI_FORWARD_PROTO \u003e /sys/kernel/debug/provoke-crash/DIRECT\nstill works as expected."
    }
  ],
  "id": "CVE-2026-90306",
  "lastModified": "2026-09-21T14:17:28.903",
  "metrics": {},
  "published": "2026-09-17T17:17:28.263",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/314f1a6762b5d51b37784ed7dc701d4c3d893703"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8ed9bff906cf8036531d1559f10e82733a52b41f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/da64b150e4b7bee615b33ab21f3137c31ec36922"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.