HIGH Introduced in 5.7
bpf LinkInfo UAF
CVE-2026-90392
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF when reading bpf link info In bpf_link_show_fdinfo and bpf_link_get_info_by_fd, link->prog is accessed without holding any locks. If the prog is concurrently replaced via bpf_link_update, the old prog can be freed, leading to a potential UAF issue. Fix this by accessing link->prog under RCU protection to safely fetch the pointer and guarantee its lifetime while reading its fields.
02KernelScan AI Analysis
Risk summary
A local attacker with BPF capabilities can exploit a race between reading BPF link information and replacing the linked program, causing a use-after-free that may lead to kernel memory corruption. Because BPF capabilities can be obtained inside a user namespace, this is reachable by unprivileged users on configurations where user namespaces are enabled, making it a potential container escape primitive. Successful exploitation could result in arbitrary kernel read/write, privilege escalation, or denial of service.
Vulnerability analysis
When userspace reads metadata about a BPF link, the kernel accesses the attached program without any synchronization. If another thread replaces that program at the same time, the old program can be freed while the kernel is still reading its contents, causing a use-after-free. The fix ensures the program pointer is safely fetched and kept valid for the entire read. The bug is reachable locally by any user with CAP_BPF, which on most systems can be obtained inside a user namespace, so an unprivileged user can trigger it unless both user namespaces and BPF access are restricted.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.6 | 5.7 | 6.6.157 | a5c936ac9047 |
| 7.2 | 5.7 | 7.2.6 | 79347e42cfbc |
| 6.18 | 5.7 | 6.18.52 | 85cf991c881e |
| mainline | 5.7 | 7.3-rc1 | 863f3ddd0b8a |
| 6.12 | 5.7 | 6.12.110 | d7d7208e2603 |
| cip/6.12 | 5.7 | 6.12.111-cip32 | d7d7208e2603 |