SB20260918355 - Use-after-free in Linux kernel bpf

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-90317)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access a freed task_struct object.

The vulnerability exists due to improper handling of RCU-protected pointers in the BPF verifier when releasing the final BPF spin lock in a sleepable BPF program and subsequently using an RCU-protected kptr. A local user can execute a BPF program that uses an RCU-protected kptr after releasing its final spin lock to access a freed task_struct object.

The pointer remains valid to the verifier after the final lock release, allowing another CPU to free the referenced object before it is used.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/180c7000712db77063b3a26f4c97e7dd9038f449
• https://git.kernel.org/stable/c/7ae71629357d0a6d0bdadb929c7b296d5b7e61c2