Linux Kernel BPF bpf_trampoline_update use after free

Summaryinfo

A vulnerability marked as very critical has been reported in Linux Kernel. This vulnerability affects the function bpf_trampoline_update of the component BPF. The manipulation leads to use after free. This vulnerability is traded as CVE-2026-90210. An attack has to be approached locally. There is no exploit available. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in Linux Kernel (the affected version is unknown). This issue affects the function bpf_trampoline_update of the component BPF. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in bpf_trampoline_multi_attach_free on update failure When bpf_trampoline_update() fails before modify_fentry_multi()/ unregister_fentry_multi() is called, cur_image is unchanged (cur_image == old_image) and ftrace still calls into it. Freeing old_image in that case causes a UAF. Only free old_image when it differs from cur_image.

It is possible to read the advisory at git.kernel.org. The identification of this vulnerability is CVE-2026-90210 since 09/11/2026. The exploitation is known to be easy. Attacking locally is a requirement. Additional levels of successful authentication are needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/17/2026).

Applying the patch 65c3939656fd7848e9274faa07c26748b5bf049c is able to eliminate this problem.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion