HIGH Introduced in 7.2
bpf TracingMulti Panic
CVE-2026-93111
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI5.5MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Mark tracing_multi trampolines as ftrace managed Since tracing_multi link does not set ftrace_managed, it would fail to release the tracing_multi link when attaching tracing_multi link and then attaching fentry link. [ 3.714215] WARNING: kernel/bpf/trampoline.c:1727 at bpf_trampoline_multi_detach+0x20b/0x240, CPU#1: test_progs/97 ... [ 3.733170] bpf_tracing_multi_link_release+0x14/0x30 [ 3.733890] bpf_link_free+0x58/0x130 [ 3.734414] bpf_link_release+0x23/0x30 Fix it by setting 'ftrace_managed = true' in register_fentry_multi().
02KernelScan AI Analysis
Risk summary
A missing flag in BPF multi-attach trampoline registration causes a kernel warning and potential failure to release tracing links when both tracing_multi and fentry links are attached. An attacker with BPF privileges can trigger this condition, leading to kernel instability or denial of service.
Vulnerability analysis
When certain BPF tracing links are used together, the setup process skips an internal tracking step. This prevents the first link from being properly torn down later, causing a kernel warning and leaving kernel tracing resources in an inconsistent state. The correction ensures the setup path records the tracing structure as managed so that cleanup proceeds normally. The flaw is reachable by any local process with privileges to load BPF programs.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 7.2 | 7.2.6 | 280145253fd3 |
| mainline | 7.2 | 7.3-rc1 | 30bdd6d1384d |