CVE-2026-90392: bpf: Fix potential UAF when reading bpf link info
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix potential UAF when reading bpf link info
In bpflinkshowfdinfo and bpflinkgetinfobyfd, link->prog is accessed without holding any locks. If the prog is concurrently replaced via bpflinkupdate, the old prog can be freed, leading to a potential UAF issue.
Fix this by accessing link->prog under RCU protection to safely fetch the pointer and guarantee its lifetime while reading its fields.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply the Linux kernel fix for: "bpf: Fix potential UAF when reading bpf link info" (UAF issue in bpf_link_show_fdinfo and bpf_link_get_info_by_fd). Ensure link->prog is accessed under RCU protection so its lifetime is guaranteed while reading its fields, preventing UAF when the prog is concurrently replaced via bpf_link_update.
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
A BPF link's associated program must be replaced concurrently through bpf_link_update while another operation reads link information through bpf_link_show_fdinfo or bpf_link_get_info_by_fd. The race can cause the reader to access an old program after it has been freed.
Which systems are exposed?
Linux kernel systems using BPF links are relevant, particularly where BPF programs can be updated with bpf_link_update while link information is being read. The provided data does not identify affected kernel versions or configuration prerequisites.
What is the remediation?
Apply a Linux kernel update containing the fix that reads link->prog under RCU protection. This ensures the program pointer remains valid while its fields are read during link-information operations.