CVE-2026-90160 Affecting kernel-tools-devel package, versions <1:6.1.188-233.385.amzn2023
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-AMZN2023-KERNELTOOLSDEVEL-20870989
- published13 Oct 2026
- disclosed17 Sept 2026
Introduced: 17 Sep 2026
NewCVE-2026-90160 (opens in a new tab)How to fix?
Upgrade Amazon-Linux:2023 kernel-tools-devel to version 1:6.1.188-233.385.amzn2023 or higher.
This issue was patched in ALAS2023-2026-3197.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-tools-devel package and not the kernel-tools-devel package as distributed by Amazon-Linux.
See How to fix? for Amazon-Linux:2023 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
lwt_bpf: Restore reserved headroom after xmit program
ip_finish_output2() expands an skb to LL_RESERVED_SPACE(dev) before LWT xmit. An LWT_XMIT BPF program can then modify the skb head and still return BPF_OK, so bpf_xmit() rechecks the remaining headroom before the skb continues to neighbour output.
That recheck uses dst->dev->hard_header_len. This is not enough for the neighbour cached-header path: neigh_hh_output() copies the cached hardware header using the aligned hh_cache size, HH_DATA_MOD for short headers or HH_DATA_ALIGN(hh_len) otherwise.
On Ethernet, hard_header_len is 14 but the cached copy needs 16 bytes. If an LWT_XMIT BPF program calls bpf_skb_change_head(skb, 1, 0), the skb can still have 15 bytes of headroom after the program. The existing check accepts that, after which neigh_hh_output() hits its headroom warning and drops the skb.
Use LL_RESERVED_SPACE(dst->dev) in the post-BPF headroom check to match the reservation made before LWT xmit.
References
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90160
- https://git.kernel.org/stable/c/179a5b2171573d94a25c9aa8e1c9f9ac352ad316
- https://git.kernel.org/stable/c/5fe7007aed9ad069b2bd77e5d0c875c64f5c0269
- https://git.kernel.org/stable/c/753e5cdcca5474d230d62bb3489e5168ab27c272
- https://git.kernel.org/stable/c/7cf561843ed0ad57501892a65abb77957e6c800f
- https://git.kernel.org/stable/c/7d043e24520a273c362be5dd7d9c82796879a49b
- https://git.kernel.org/stable/c/a38c0eb447e2dd0120a2ebcdba470f9505ac8907
- https://git.kernel.org/stable/c/c488071c3441fa34f5a87cd6c12ce2cc6304f20e
- https://git.kernel.org/stable/c/de2b2004e16f2930eb689175e2c1998b0a68d499