CVE-2026-90393
Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF in bpf_netns_link_update_prog In bpf_netns_link_update_prog, the checks for old_prog and prog type are currently performed locklessly before acquiring netns_bpf_mutex. This creates a race condition that can lead to a UAF issue. If two threads concurrently execute BPF_LINK_UPDATE on the same netns link, the following execution path can trigger a UAF: CPU0 CPU1 bpf_netns_link_update_prog if (old_prog && old_prog != link->prog) return -EPERM; bpf_netns_link_update_prog if (old_prog && old_prog != link->prog) ... old_prog = xchg(&link->prog, new_prog); bpf_prog_put(old_prog); if (new_prog->type != link->prog->type) <-- trigger UAF Fix this by moving the old_prog and prog->type checks inside the netns_bpf_mutex critical section. Meanwhile, use guard() to simplify lock management and avoid all the goto jumping.
How to fix
- Linux Linuxd462b5481d77ce7df8a5ff89a699386f00c9214d, bdddf3e1493ee973619c154a57071ce67f78598b, 79a66fd997d4eecf17302d613194879eb32e0986, f4ce6803df4095777191d800bebc50219b615ca0, 277168cb9d153ce8e9c3f9275670e32ae61b41d6, bda86e9f31b9a296b6e64a51c91dc776fc9f613e, 923f559e95b89b33c7e1793b3d8f7f4ec9b2e4b7, 5c5997836381010fc5907b36bc17d3b19407e933 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 7f045a49fee04b5662cbdeaf0838f9322ae8c63a ≤ v < d462b5481d77ce7df8a5ff89a699386f00c9214d, 7f045a49fee04b5662cbdeaf0838f9322ae8c63a ≤ v < bdddf3e1493ee973619c154a57071ce67f78598b, 7f045a49fee04b5662cbdeaf0838f9322ae8c63a ≤ v < 79a66fd997d4eecf17302d613194879eb32e0986, 7f045a49fee04b5662cbdeaf0838f9322ae8c63a ≤ v < f4ce6803df4095777191d800bebc50219b615ca0, 7f045a49fee04b5662cbdeaf0838f9322ae8c63a ≤ v < 277168cb9d153ce8e9c3f9275670e32ae61b41d6, 7f045a49fee04b5662cbdeaf0838f9322ae8c63a ≤ v < bda86e9f31b9a296b6e64a51c91dc776fc9f613e, 7f045a49fee04b5662cbdeaf0838f9322ae8c63a ≤ v < 923f559e95b89b33c7e1793b3d8f7f4ec9b2e4b7, 7f045a49fee04b5662cbdeaf0838f9322ae8c63a ≤ v < 5c5997836381010fc5907b36bc17d3b19407e933, 5.8 | d462b5481d77ce7df8a5ff89a699386f00c9214d, bdddf3e1493ee973619c154a57071ce67f78598b, 79a66fd997d4eecf17302d613194879eb32e0986, f4ce6803df4095777191d800bebc50219b615ca0, 277168cb9d153ce8e9c3f9275670e32ae61b41d6, bda86e9f31b9a296b6e64a51c91dc776fc9f613e, 923f559e95b89b33c7e1793b3d8f7f4ec9b2e4b7, 5c5997836381010fc5907b36bc17d3b19407e933 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.