HIGH Introduced in 5.9
bpf CgroupStorage UAF
CVE-2026-90313
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed A potential invalid storage access issue can occur after replacing a cgroup bpf prog. This occurs in the following scenario: 1. prog1 with storage is attached to a cgroup in multi-attach mode. 2. prog1 is replaced with prog2 using BPF_F_REPLACE in multi-attach mode, but fails midway (e.g. in bpf_trampoline_link_cgroup_shim or update_effective_progs). 3. A new prog3 is attached to the cgroup in multi-attach mode. The reason is that __cgroup_bpf_attach overwrites pl->storage with the new storage prior to attachment completion. When attachment fails midway, the cleanup path calls bpf_cgroup_storages_free(new_storage) to free the newly allocated storage, but fails to restore pl->storage back to old_storage. Consequently, the still-active prog1 holds invalid or dangling storage pointers, leading to an invalid memory access when prog1 executes and calls bpf_get_local_storage. Additionally, original pl->flags and cgrp->bpf.flags[atype] are left unrestored. Fix this by saving old_pl_flags, old_storage, and old_flags prior to the update, and properly restoring all of them in the cleanup path on error.
02KernelScan AI Analysis
Risk summary
A use-after-free in the BPF cgroup attach path allows a local attacker with BPF privileges to corrupt kernel memory by triggering a failed program replacement that leaves dangling storage pointers. This can lead to arbitrary kernel read/write, privilege escalation, or denial of service. Systems that allow unprivileged BPF or user namespace BPF access are at highest risk.
Vulnerability analysis
When a cgroup BPF program that uses local storage is replaced with another program in multi-attach mode, the attach logic overwrites the program's storage with newly allocated storage before the replacement is fully complete. If the replacement fails midway, the error cleanup frees the new storage but fails to restore the original program's storage, leaving the still-active original program referencing freed memory. When that program later runs and accesses its local storage, it dereferences dangling pointers, causing a use-after-free. The fix saves the original storage, program flags, and cgroup flags before the replacement begins and restores all of them in the error cleanup path, ensuring the original program retains valid storage on failure. This vulnerability is reachable locally by a user who can load BPF programs and attach them to cgroups, which on most systems requires privileges to load and attach BPF programs, potentially obtainable through user namespaces where unprivileged BPF is permitted.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 5.9 | 6.12.110 | aaca16e04252 |
| 7.2 | 5.9 | 7.2.6 | 2c2218560b6e |
| mainline | 5.9 | 7.3-rc1 | 6655c409707e |
| 6.18 | 5.9 | 6.18.52 | 86ead1763011 |
| 6.6 | 5.9 | 6.6.157 | e26db0d636e4 |
| cip/6.12 | 5.9 | 6.12.111-cip32 | aaca16e04252 |