HIGH Introduced in 7.2
bpf MultiAttach UAF
CVE-2026-90210
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in bpf_trampoline_multi_attach_free on update failure When bpf_trampoline_update() fails before modify_fentry_multi()/ unregister_fentry_multi() is called, cur_image is unchanged (cur_image == old_image) and ftrace still calls into it. Freeing old_image in that case causes a UAF. Only free old_image when it differs from cur_image.
02KernelScan AI Analysis
Risk summary
A local user with BPF capabilities can trigger a use-after-free in the BPF trampoline multi-attach cleanup path when a trampoline update fails. The freed memory is still referenced by ftrace, leading to potential kernel code execution or crash. This requires specific kernel configuration (dynamic ftrace with direct calls, x86_64) and CAP_BPF privileges.
Vulnerability analysis
A failure during a BPF trampoline multi-attach update can leave a memory image still in use by the kernel's function tracing system. The cleanup path then frees that image while ftrace continues to call into it, causing a use-after-free. The change ensures the old image is only freed once it is no longer the active one. This path is reachable by a local user with BPF program loading privileges on x86_64 systems with dynamic ftrace direct calls enabled.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 7.2 | 7.2.6 | 65c3939656fd |
| mainline | 7.2 | 7.3-rc1 | 0253073fb7d7 |