CVE-2026-90317 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf: Invalidate RCU pointers after final spin unlock
In a sleepable BPF program, a spin lock can provide the only RCU protection for a kptr. The final bpf_spin_unlock() ends that protection, but the verifier leaves the pointer valid. Another CPU can then free the object before the pointer is used. A capability-limited runtime PoC triggered a task_struct use-after-free in __bpf_get_task_stack().
Record whether the program is in an RCU-protected context before releasing the lock. Invalidate RCU-protected pointers only when the unlock leaves the final such context. This preserves valid pointers in non-sleepable programs and inside an explicit RCU read-side section.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel contains a critical vulnerability within its Berkeley Packet Filter subsystem, specifically affecting sleepable BPF programs that utilize spin locks for synchronization. The core issue arises from the interaction between reference-counted pointers, known as kptrs, and Read-Copy-Update mechanisms. In certain scenarios, particularly within sleepable contexts where traditional RCU read-side critical sections are not available or applicable, a spin lock serves as the sole mechanism providing protection for these kernel pointers. The vulnerability stems from the verifier's handling of pointer validity after the release of such locks. When a bpf_spin_unlock operation is executed, it effectively terminates the protective scope provided by that specific lock instance. However, the BPF verifier fails to recognize this transition and incorrectly retains the validity status of the RCU-protected pointers in its internal state tracking.
This oversight creates a dangerous race condition where another CPU core can free the underlying object referenced by the pointer immediately after the spin unlock but before the BPF program attempts to dereference it. Because the verifier believes the pointer remains valid, it does not enforce necessary safety checks or nullifications at this critical juncture. Consequently, if the original owner of the kptr releases its reference and frees the memory during this window, any subsequent access by another CPU executing the same BPF program results in a use-after-free condition. This flaw was demonstrated through a capability-limited runtime proof-of-concept that successfully triggered a task_struct use-after-free within the __bpf_get_task_stack function, highlighting the severity of the issue as it can lead to kernel crashes or potential privilege escalation depending on the context and attacker capabilities.
The technical root cause is classified under CWE-416, Use After Free, which describes situations where software continues to use a pointer after it has been freed, leading to undefined behavior. From an offensive security perspective, this vulnerability aligns with MITRE ATT&CK technique T1059, Command and Scripting Interpreter, as BPF programs are often used for complex scripting tasks within the kernel space. The exploitation vector involves manipulating the timing of lock releases and memory deallocation to exploit the window where the verifier's state is out of sync with actual runtime safety guarantees. This misalignment allows an attacker who can influence or trigger specific BPF program executions to corrupt kernel memory structures, potentially gaining unauthorized access to sensitive data or executing arbitrary code within the kernel context.
To mitigate this vulnerability, a patch has been implemented that fundamentally changes how RCU-protected pointers are managed in relation to spin lock operations. The fix requires the system to record whether the current BPF program execution is operating within an RCU-protected context prior to releasing any locks. Crucially, the logic for invalidating these protected pointers is now conditional; they are only invalidated when the unlock operation results in leaving the final such protective context. This approach ensures that valid pointers remain accessible and safe for use in non-sleepable programs or within explicit RCU read-side sections where other protection mechanisms may still be active. By accurately tracking the depth of RCU nesting, the kernel prevents premature invalidation while ensuring that pointers are cleared when they truly become unsafe due to lock release.
Administrators and developers should ensure that their Linux systems are updated with the latest kernel patches addressing this BPF verifier flaw. Since sleepable BPF programs offer powerful capabilities for tracing and monitoring but also expand the attack surface, strict adherence to security best practices is essential. This includes limiting which users or processes can load unprivileged BPF programs and regularly auditing BPF code for proper synchronization patterns. The resolution emphasizes the importance of maintaining accurate state tracking in kernel verifiers to prevent race conditions that compromise memory safety. By correcting this logic error, the Linux kernel restores the integrity of RCU protections associated with spin locks in sleepable contexts, thereby eliminating the window for use-after-free exploits targeting task structures and other critical kernel objects.