SB20260528241 - Use-after-free in Linux kernel bpf

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-45837)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in arena_vm_close and bpf_arena_free_pages when handling inherited arena VMAs after a fork. A local user can trigger a stale VMA reference by calling bpf_arena_free_pages() in a child process after the parent unmaps the arena to cause a denial of service.

The issue occurs when an arena VMA is inherited across fork and the child retains a pointer to the parent VMA.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/201128fcc7b213d27ab77bc4e89488b41796480f
• https://git.kernel.org/stable/c/4fddde2a732de60bb97e3307d4eb69ac5f1d2b74
• https://git.kernel.org/stable/c/723b9fa930cc277c15ce6b9ec9feec828cfac9d7
• https://git.kernel.org/stable/c/d18099f19e53250f8ad2801498b88cec29d9107a