CVE-2026-90393

bpf: Fix potential UAF in bpf_netns_link_update_prog

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix potential UAF in bpf_netns_link_update_prog

In bpf_netns_link_update_prog, the checks for old_prog and prog type are currently performed locklessly before acquiring netns_bpf_mutex. This creates a race condition that can lead to a UAF issue.

If two threads concurrently execute BPF_LINK_UPDATE on the same netns link, the following execution path can trigger a UAF:

CPU0 CPU1 bpf_netns_link_update_prog if (old_prog && old_prog != link->prog) return -EPERM; bpf_netns_link_update_prog if (old_prog && old_prog != link->prog) ... old_prog = xchg(&link->prog, new_prog); bpf_prog_put(old_prog); if (new_prog->type != link->prog->type) <-- trigger UAF

Fix this by moving the old_prog and prog->type checks inside the netns_bpf_mutex critical section. Meanwhile, use guard() to simplify lock management and avoid all the goto jumping.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	7f045a49fee04b5662cbdeaf0838f9322ae8c63a to before d462b5481d77ce7df8a5ff89a699386f00c9214dAffected 7f045a49fee04b5662cbdeaf0838f9322ae8c63a to before bdddf3e1493ee973619c154a57071ce67f78598bAffected 7f045a49fee04b5662cbdeaf0838f9322ae8c63a to before 79a66fd997d4eecf17302d613194879eb32e0986Affected 7f045a49fee04b5662cbdeaf0838f9322ae8c63a to before f4ce6803df4095777191d800bebc50219b615ca0Affected 7f045a49fee04b5662cbdeaf0838f9322ae8c63a to before 277168cb9d153ce8e9c3f9275670e32ae61b41d6Affected 7f045a49fee04b5662cbdeaf0838f9322ae8c63a to before bda86e9f31b9a296b6e64a51c91dc776fc9f613eAffected 7f045a49fee04b5662cbdeaf0838f9322ae8c63a to before 923f559e95b89b33c7e1793b3d8f7f4ec9b2e4b7Affected 7f045a49fee04b5662cbdeaf0838f9322ae8c63a to before 5c5997836381010fc5907b36bc17d3b19407e933Affected
LinuxLinux	5.8Affected before 5.8Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

7f045a49fee04b5662cbdeaf0838f9322ae8c63a to before d462b5481d77ce7df8a5ff89a699386f00c9214dAffected
7f045a49fee04b5662cbdeaf0838f9322ae8c63a to before bdddf3e1493ee973619c154a57071ce67f78598bAffected
7f045a49fee04b5662cbdeaf0838f9322ae8c63a to before 79a66fd997d4eecf17302d613194879eb32e0986Affected
7f045a49fee04b5662cbdeaf0838f9322ae8c63a to before f4ce6803df4095777191d800bebc50219b615ca0Affected
7f045a49fee04b5662cbdeaf0838f9322ae8c63a to before 277168cb9d153ce8e9c3f9275670e32ae61b41d6Affected
7f045a49fee04b5662cbdeaf0838f9322ae8c63a to before bda86e9f31b9a296b6e64a51c91dc776fc9f613eAffected
7f045a49fee04b5662cbdeaf0838f9322ae8c63a to before 923f559e95b89b33c7e1793b3d8f7f4ec9b2e4b7Affected
7f045a49fee04b5662cbdeaf0838f9322ae8c63a to before 5c5997836381010fc5907b36bc17d3b19407e933Affected

LinuxLinux

5.8Affected
before 5.8Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.