CVE-2026-93111: bpf: Mark tracing_multi trampolines as ftrace managed
In the Linux kernel, the following vulnerability has been resolved:
bpf: Mark tracingmulti trampolines as ftrace managed
Since tracingmulti link does not set ftracemanaged, it would fail to release the tracingmulti link when attaching tracingmulti link and then attaching fentry link.
[ 3.714215] WARNING: kernel/bpf/trampoline.c:1727 at bpftrampolinemultidetach+0x20b/0x240, CPU#1: testprogs/97 ... [ 3.733170] bpftracingmultilinkrelease+0x14/0x30 [ 3.733890] bpflinkfree+0x58/0x130 [ 3.734414] bpflinkrelease+0x23/0x30
Fix it by setting 'ftracemanaged = true' in registerfentrymulti().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix the vulnerability by setting 'ftrace_managed = true' in register_fentry_multi() so tracing_multi links are marked as ftrace managed.
Linux kernel (kernel/bpf trampoline/tracing_multi link) ftrace_managed (set via register_fentry_multi()) = true - Operational
Ensure the tracing_multi link is released when attaching the tracing_multi link and then attaching the fentry link.
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
The issue is triggered by attaching a tracing_multi link and then attaching an fentry link. The affected path is specifically the release of the tracing_multi link after those attachments.
What is the observable symptom if a system is affected?
Releasing the tracing_multi link can fail and produce a kernel warning from bpf_trampoline_multi_detach. The supplied trace shows the warning occurring during bpf_tracing_multi_link_release and bpf_link_free.
Is a workaround described for systems that cannot apply the fix immediately?
No workaround is provided in the available data. Avoiding the stated sequence of attaching a tracing_multi link followed by an fentry link would avoid the described trigger.