CVE-2026-90269: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-2xhx-g2j2-v5cp
Share
Published
Advisory Summary

CVE-2026-90269 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-90269 at a Glance

CVE Identifier CVE-2026-90269
GHSA Identifier GHSA-2xhx-g2j2-v5cp
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-90269

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-90269, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject load-acquire from pointers requiring fault protection A BPF_LOAD_ACQ is not rewritten to a BPF_PROBE_MEM load by the verifier, unlike a regular BPF_LDX, so the JIT emits a plain load with no exception table entry and a fault panics the kernel instead of being handled. Reject the source pointer types that a BPF_LDX would have had that fault protection applied to, i.e. the ones bpf_convert_ctx_accesses() turns into BPF_PROBE_MEM: a bare PTR_TO_BTF_ID, PTR_TO_BTF_ID | PTR_UNTRUSTED, PTR_TO_BTF_ID | MEM_ALLOC | PTR_UNTRUSTED and PTR_TO_MEM | MEM_RDONLY | PTR_UNTRUSTED. This is reachable e.g. by loading ->mm out of a trusted task_struct yields an untrusted pointer to mm_struct, and it is NULL for a kernel thread: [...] SEC("tp_btf/sched_switch") int BPF_PROG(demo, bool preempt, struct task_struct *prev, struct task_struct *next) { struct mm_struct *mm = next->mm; /* untrusted */ out_ldx = (__u64)mm->pgd; /* BPF_LDX */ out_acq = load_acquire(&mm->pgd); /* BPF_LOAD_ACQ */ return 0; } [...] Both dereference the same pointer, but only the BPF_LDX is protected (x86-64 JIT, jump targets shown prog-relative): [...] ; out_ldx = (__u64)mm->pgd; 17: movq $-10485760, %r10 1e: movq %rsi, %r11 21: addq $184, %r11 28: subq %r10, %r11 2b: movabsq $140737498841088, %r10 35: cmpq %r10, %r11 38: ja 0x3e <-- kernel addr? 3a: xorl %edi, %edi <-- no: dst = 0, skip the load 3c: jmp 0x45 3e: movq 184(%rsi), %rdi <-- yes: load + extable entry [...] ; load_acquire(&mm->pgd) 53: movq %rsi, %rdi 56: movq 184(%rdi), %rax <-- no check, no extable entry [...] Note that BPF_PROBE_MEM is not visible in a bpftool xlated dump, as bpf_insn_prepare_dump() rewrites it back to BPF_MEM. A PTR_TRUSTED pointer is deliberately not on the list. Such a load is not converted either, but it does not need to be, since the pointer is guaranteed live, so load-acquire from it stays allowed. The check is gated on BPF_LOAD_ACQ so that atomic RMW and store-release error messages are unchanged; writes (RMW / store-release) to such pointers are already rejected elsewhere, so only load-acquire needs this.

References

NVD — CVE-2026-90269 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90269
git.kernel.org/stable/c/5f8ade6e9b... WEB
https://git.kernel.org/stable/c/5f8ade6e9b7931fc9697394f1b2c4ae833f5ac18
git.kernel.org/stable/c/7db0a00445... WEB
https://git.kernel.org/stable/c/7db0a00445f1a40bacfe9b747405c11cb5f10fc9
git.kernel.org/stable/c/c4c8de3bf4... WEB
https://git.kernel.org/stable/c/c4c8de3bf48d3756ab0f910fe5cc4937d70efdcd

Frequently Asked Questions

What is CVE-2026-90269?
CVE-2026-90269 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-90269?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-90269?
CVE-2026-90269 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-90269?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-2xhx-g2j2-v5cp",
  "modified" : "2026-09-17T18:31:58Z",
  "published" : "2026-09-17T18:31:58Z",
  "aliases" : [ "CVE-2026-90269" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject load-acquire from pointers requiring fault protection\n\nA BPF_LOAD_ACQ is not rewritten to a BPF_PROBE_MEM load by the verifier,\nunlike a regular BPF_LDX, so the JIT emits a plain load with no exception\ntable entry and a fault panics the kernel instead of being handled.\n\nReject the source pointer types that a BPF_LDX would have had that fault\nprotection applied to, i.e. the ones bpf_convert_ctx_accesses() turns\ninto BPF_PROBE_MEM: a bare PTR_TO_BTF_ID, PTR_TO_BTF_ID | PTR_UNTRUSTED,\nPTR_TO_BTF_ID | MEM_ALLOC | PTR_UNTRUSTED and PTR_TO_MEM | MEM_RDONLY |\nPTR_UNTRUSTED.\n\nThis is reachable e.g. by loading ->mm out of a trusted task_struct\nyields an untrusted pointer to mm_struct, and it is NULL for a kernel\nthread:\n\n  [...]\n  SEC(\"tp_btf/sched_switch\")\n  int BPF_PROG(demo, bool preempt, struct task_struct *prev,\n               struct task_struct *next)\n  {\n      struct mm_struct *mm = next->mm;  /* untrusted */\n\n      out_ldx = (__u64)mm->pgd;         /* BPF_LDX      */\n      out_acq = load_acquire(&mm->pgd); /* BPF_LOAD_ACQ */\n      return 0;\n  }\n  [...]\n\nBoth dereference the same pointer, but only the BPF_LDX is protected\n(x86-64 JIT, jump targets shown prog-relative):\n\n  [...]\n  ; out_ldx = (__u64)mm->pgd;\n  17:   movq    $-10485760, %r10\n  1e:   movq    %rsi, %r11\n  21:   addq    $184, %r11\n  28:   subq    %r10, %r11\n  2b:   movabsq $140737498841088, %r10\n  35:   cmpq    %r10, %r11\n  38:   ja      0x3e                 <-- kernel addr?\n  3a:   xorl    %edi, %edi           <-- no: dst = 0, skip the load\n  3c:   jmp     0x45\n  3e:   movq    184(%rsi), %rdi      <-- yes: load + extable entry\n  [...]\n  ; load_acquire(&mm->pgd)\n  53:\tmovq    %rsi, %rdi\n  56:\tmovq    184(%rdi), %rax       <-- no check, no extable entry\n  [...]\n\nNote that BPF_PROBE_MEM is not visible in a bpftool xlated dump, as\nbpf_insn_prepare_dump() rewrites it back to BPF_MEM.\n\nA PTR_TRUSTED pointer is deliberately not on the list. Such a load is\nnot converted either, but it does not need to be, since the pointer is\nguaranteed live, so load-acquire from it stays allowed.\n\nThe check is gated on BPF_LOAD_ACQ so that atomic RMW and store-release\nerror messages are unchanged; writes (RMW / store-release) to such\npointers are already rejected elsewhere, so only load-acquire needs this.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-90269"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/5f8ade6e9b7931fc9697394f1b2c4ae833f5ac18"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/7db0a00445f1a40bacfe9b747405c11cb5f10fc9"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c4c8de3bf48d3756ab0f910fe5cc4937d70efdcd"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-17T17:17:23Z"
  }
}