HIGH
bpf Trampoline Shim UAF
CVE-2026-23319
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim The root cause of this bug is that when 'bpf_link_put' reduces the refcount of 'shim_link->link.link' to zero, the resource is considered released but may still be referenced via 'tr->progs_hlist' in 'cgroup_shim_find'. The actual cleanup of 'tr->progs_hlist' in 'bpf_shim_tramp_link_release' is deferred. During this window, another process can cause a use-after-free via 'bpf_trampoline_link_cgroup_shim'. Based on Martin KaFai Lau's suggestions, I have created a simple patch. To fix this: Add an atomic non-zero check in 'bpf_trampoline_link_cgroup_shim'. Only increment the refcount if it is not already zero. Testing: I verified the fix by adding a delay in 'bpf_shim_tramp_link_release' to make the bug easier to trigger: static void bpf_shim_tramp_link_release(struct bpf_link *link) { /* ... */ if (!shim_link->trampoline) return; + msleep(100); WARN_ON_ONCE(bpf_trampoline_unlink_prog(&shim_link->link, shim_link->trampoline, NULL)); bpf_trampoline_put(shim_link->trampoline); } Before the patch, running a PoC easily reproduced the crash(almost 100%) with a call trace similar to KaiyanM's report. After the patch, the bug no longer occurs even after millions of iterations.
02KernelScan AI Analysis
Risk summary
An attacker with BPF program loading privileges could trigger a use-after-free condition in the kernel's BPF trampoline system by exploiting a race condition during cgroup shim link management. This could lead to kernel crashes, memory corruption, or potentially privilege escalation. The vulnerability is particularly concerning in multi-tenant environments where BPF programs are used for security enforcement.
Vulnerability analysis
Root Cause: A race condition exists in the BPF trampoline cgroup shim mechanism where a shim_link can be found via cgroup_shim_find() and have its reference count incremented even after bpf_link_put() has reduced the refcount to zero. The cleanup of tr->progs_hlist in bpf_shim_tramp_link_release() is deferred, creating a window where the freed object can still be accessed.
Attack Surface: This vulnerability affects local processes that can load and manipulate BPF programs with LSM cgroup attachment capabilities. The attack requires the ability to create multiple BPF programs and trigger concurrent operations on trampoline shim links, which typically requires CAP_BPF or CAP_SYS_ADMIN privileges.
Fix Mechanism: The patch replaces the unsafe bpf_link_inc() call with bpf_link_inc_not_zero(), which atomically checks if the reference count is non-zero before incrementing it. This prevents incrementing the refcount of an already-freed object. If the refcount is zero, the function returns an error and the code path continues to create a new shim instead of reusing the freed one.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 6.1 | 6.1.167 | 529e685e522b |
| 6.12 | 6.12.77 | cfcfa0ca0212 |
| 6.18 | 6.18.17 | 3eeddb80191f |
| 6.19 | 6.19.7 | 4e8a0005d633 |
| 6.6 | 6.6.130 | 9b02c5c4147f |
| mainline | 7.0 | 56145d237385 |