CVE-2026-90392

bpf: Fix potential UAF when reading bpf link info

State: Published
Severity: 7.8 High
Published: Sep 17, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix potential UAF when reading bpf link info

In bpf_link_show_fdinfo and bpf_link_get_info_by_fd, link->prog is accessed without holding any locks. If the prog is concurrently replaced via bpf_link_update, the old prog can be freed, leading to a potential UAF issue.

Fix this by accessing link->prog under RCU protection to safely fetch the pointer and guarantee its lifetime while reading its fields.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	0c991ebc8c69d29b7fc44db17075c5aa5253e2ab to before 4c8432a332d4a24dc2742f56062a53d8fad36f53Affected 0c991ebc8c69d29b7fc44db17075c5aa5253e2ab to before a5c936ac904767fc1d943d40b0308bcb2ae2509bAffected 0c991ebc8c69d29b7fc44db17075c5aa5253e2ab to before d7d7208e2603b45724b684f4df73904fb347741eAffected 0c991ebc8c69d29b7fc44db17075c5aa5253e2ab to before 85cf991c881e7198be32be05a9daa2625390c8b3Affected 0c991ebc8c69d29b7fc44db17075c5aa5253e2ab to before 79347e42cfbc9e78872922e8f08a70609c9af82fAffected 0c991ebc8c69d29b7fc44db17075c5aa5253e2ab to before 863f3ddd0b8ac65abfb50d3be0869268ac0e277bAffected
LinuxLinux	5.7Affected before 5.7Not affected 6.1.191 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

0c991ebc8c69d29b7fc44db17075c5aa5253e2ab to before 4c8432a332d4a24dc2742f56062a53d8fad36f53Affected
0c991ebc8c69d29b7fc44db17075c5aa5253e2ab to before a5c936ac904767fc1d943d40b0308bcb2ae2509bAffected
0c991ebc8c69d29b7fc44db17075c5aa5253e2ab to before d7d7208e2603b45724b684f4df73904fb347741eAffected
0c991ebc8c69d29b7fc44db17075c5aa5253e2ab to before 85cf991c881e7198be32be05a9daa2625390c8b3Affected
0c991ebc8c69d29b7fc44db17075c5aa5253e2ab to before 79347e42cfbc9e78872922e8f08a70609c9af82fAffected
0c991ebc8c69d29b7fc44db17075c5aa5253e2ab to before 863f3ddd0b8ac65abfb50d3be0869268ac0e277bAffected

LinuxLinux

5.7Affected
before 5.7Not affected
6.1.191 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.