CVE-2026-90210: bpf: Fix UAF in bpf_trampoline_multi_attach_free on update failure
Published Sep 17, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix UAF in bpftrampolinemultiattachfree on update failure
When bpftrampolineupdate() fails before modifyfentrymulti()/ unregisterfentrymulti() is called, curimage is unchanged (curimage == oldimage) and ftrace still calls into it. Freeing oldimage in that case causes a UAF.
Only free oldimage when it differs from curimage.
Affected Software
1 affected component
Linux Linux kernel
Event History
Sep 17, 2026
CVE Published
via MITRE·04:07 PM
Data Sourced
via MITRE·04:07 PM
Description
Frequently Asked Questions
1
What condition is required for the use-after-free to occur?
bpf_trampoline_update() must fail before modify_fentry_multi() or unregister_fentry_multi() is called. In that state, cur_image still equals old_image and ftrace can continue calling the old image.
2
Which Linux kernel functionality is involved?
The issue is in the BPF trampoline multi-attach cleanup path. Systems are relevant when this path is used and an update fails at the specified stage.