CVE-2026-45951: bpf: Fix a potential use-after-free of BTF object
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix a potential use-after-free of BTF object
Refcounting in the checkpseudobtfid() function is incorrect: the checkpseudobtfid() function might get called with a zero refcounted btf. Fix this, and patch related code accordingly.
v3: rephrase a comment (AI) v2: fix a refcount leak introduced in v1 (AI)
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates local access and low privileges are required. No user interaction is required.
Is this directly exploitable over the network?
The attack vector is local (AV:L), so the provided scoring does not indicate direct remote-network exploitation.
What is the potential impact of successful exploitation?
The CVSS vector assigns high impact to confidentiality, integrity, and availability. This indicates a successful exploit could expose data, alter data, or disrupt the affected system.