CVE-2026-90392

What it actually does

Use-after-free when bpf_link_show_fdinfo or bpf_link_get_info_by_fd dereference link->prog without synchronization while bpf_link_update can concurrently free the prog object.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel memory corruption, leading to crashes, information disclosure, or privilege escalation; high-privilege BPF workloads increase exposure surface.

How an attack unfolds

An attacker with local access opens a bpf link, starts concurrent threads that call bpf_link_update to replace the attached program while simultaneously invoking link info read paths, racing the freed prog pointer access to achieve UAF.

How to fix it

Upgrade the Linux kernel to a version containing the RCU-protected access fix for bpf_link info functions; rebuild and reboot systems with the patched kernel; apply vendor backports where available.

How to confirm the fix worked

Verify the running kernel contains the commit that adds rcu_read_lock/unlock around link->prog accesses in bpf_link_show_fdinfo and bpf_link_get_info_by_fd; inspect kernel source or changelog for the UAF resolution; test with concurrent link update and info read workloads under memory debugging tools.

Typical attack path

1. Obtain local unprivileged or low-privileged shell on target Linux host
2. Load or attach BPF programs to create bpf_link objects
3. Race bpf_link_update with bpf_link_show_fdinfo or bpf_link_get_info_by_fd calls
4. Trigger dereference of freed prog pointer to corrupt kernel memory or leak data
5. Escalate privileges or cause denial of service

How to detect it

Search kernel logs for oops, warnings, or slab-use-after-free reports referencing bpf_link or bpf_prog; inspect audit logs for unusual sequences of BPF link update and fdinfo operations; correlate with process activity involving bpftool or custom BPF loaders.

What your security team should do

• Prioritize kernel updates on systems exposing BPF to untrusted local users
• Restrict unprivileged BPF loading via sysctl kernel.unprivileged_bpf_disabled=1 until patched
• Monitor for kernel oops or warnings involving bpf_link structures
• Audit custom BPF tooling for use of link update and info query patterns