CVE-2026-90392 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix potential UAF when reading bpf link info
In bpf_link_show_fdinfo and bpf_link_get_info_by_fd, link->prog is accessed without holding any locks. If the prog is concurrently replaced via bpf_link_update, the old prog can be freed, leading to a potential UAF issue.
Fix this by accessing link->prog under RCU protection to safely fetch the pointer and guarantee its lifetime while reading its fields.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel's Berkeley Packet Filter (BPF) subsystem provides a powerful framework for running sandboxed programs in the kernel, enabling features such as network filtering, performance monitoring, and security enforcement. A critical vulnerability was identified within the mechanisms used to expose BPF link information to user space through file descriptor interfaces. Specifically, the functions bpf_link_show_fdinfo and bpf_link_get_info_by_fd are responsible for retrieving details about a BPF link object, which associates a specific program with its attachment point. These operations involve accessing the internal prog pointer stored within the link structure to gather metadata or state information required by user-space applications like libbpf or debugging tools.
The core technical flaw lies in the lack of synchronization when accessing this prog pointer during read-only operations. In concurrent execution scenarios, a BPF program associated with a link can be updated or replaced via the bpf_link_update system call. This update process involves dereferencing the old program and potentially freeing its memory resources once it is no longer referenced by other active components. However, because the information retrieval functions did not hold any locks or utilize proper synchronization primitives when reading link->prog, a race condition exists. An attacker or malicious user-space application could trigger an info query at precisely the moment that bpf_link_update is replacing the program. If this timing aligns such that the old program has been dereferenced and freed by one thread but its pointer value is still read by another thread in the information retrieval path, a Use-After-Free (UAF) condition occurs.
This vulnerability falls under CWE-416, which describes using an invalidated reference or bad memory reference, specifically manifesting as a use-after-free scenario. The operational impact of this flaw can be severe depending on the context in which it is exploited. A successful exploitation could allow for arbitrary code execution within kernel space by leveraging the freed memory to overwrite critical data structures or execute shellcode placed in the reclaimed memory region. Alternatively, even without achieving full code execution, the vulnerability can lead to a kernel panic or system crash due to accessing invalid memory addresses, resulting in a denial of service condition. Given that BPF programs often run with high privileges and deep access to kernel internals, this represents a significant security risk for systems relying on eBPF for network policies, observability, or runtime security enforcement.
The remediation strategy implemented by the Linux kernel maintainers involves enforcing Read-Copy-Update (RCU) protection around the access of link->prog. RCU is a synchronization mechanism designed to allow high-performance concurrent read operations while ensuring that data structures are not freed until all readers have completed their access. By wrapping the pointer retrieval and subsequent field accesses in appropriate RCU primitives, such as rcu_dereference_protected or similar variants depending on the specific context lock state, the kernel guarantees that the program object remains valid for the duration of the read operation. This prevents the scenario where a concurrent update frees the memory while it is still being accessed by an information retrieval function.
From a defensive perspective and alignment with industry standards like MITRE ATT&CK, this vulnerability relates to techniques involving exploitation of software vulnerabilities during privilege escalation or defense evasion phases. The fix ensures that even if an attacker attempts to race condition the program update against info queries, the kernel's memory safety guarantees prevent access to freed objects. System administrators should ensure their kernels are updated with patches addressing CVE details related to BPF link handling. Additionally, developers writing custom eBPF applications or security tools interacting with these interfaces must be aware that older versions of the kernel may exhibit this behavior, and upgrading is necessary to maintain system integrity against potential exploitation attempts targeting race conditions in kernel subsystems.