CVE-2026-23319bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim
Updated under an hour ago ()
Does this affect you?
It affects Linux and 5 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim The root cause of this bug is that when 'bpf_link_put' reduces the refcount of 'shim_link->link.link' to zero, the resource is considered released but may still be referenced via 'tr->progs_hlist' in 'cgroup_shim_find'. The actual cleanup of 'tr->progs_hlist' in 'bpf_shim_tramp_link_release' is deferred. During this window, another process can cause a use-after-free via 'bpf_trampoline_link_cgroup_shim'. Based on Martin KaFai Lau's suggestions, I have created a simple patch. To fix this: Add an atomic non-zero check in 'bpf_trampoline_link_cgroup_shim'. Only increment the refcount if it is not already zero. Testing: I verified the fix by adding a delay in 'bpf_shim_tramp_link_release' to make the bug easier to trigger: static void bpf_shim_tramp_link_release(struct bpf_link *link) { /* ... */ if (!shim_link->trampoline) return; + msleep(100); WARN_ON_ONCE(bpf_trampoline_unlink_prog(&shim_link->link, shim_link->trampoline, NULL)); bpf_trampoline_put(shim_link->trampoline); } Before the patch, running a PoC easily reproduced the crash(almost 100%) with a call trace similar to KaiyanM's report. After the patch, the bug no longer occurs even after millions of iterations.
- CVSS
- 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e before 529e685e522b9d7fb379dbe6929dcdf520e34c8c; 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e builds before 9b02c5c4147f8af8ed783c8deb5df927a55c3951; from 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e before cfcfa0ca0212162aa472551266038e8fd6768cff; 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e builds before 3eeddb80191f7626ec1ef742bfff51ec3b0fa5c2; 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e builds before 4e8a0005d633a4adc98e3b65d5080f93b90d356b; from 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e before 56145d237385ca0e7ca9ff7b226aaf2eb8ef368b | CNA record |
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name) | all versions | CISA ADP |
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
linux linux_kernel linux:linux_kernel | from 6.0.1 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.77; from 6.13 before 6.18.17; from 6.19 before 6.19.7; 6.0; 7.0; 7.0; and 5 more ranges | NVD |
References
- https://git.kernel.org/stable/c/529e685e522b9d7fb379dbe6929dcdf520e34c8cpatch
- https://git.kernel.org/stable/c/9b02c5c4147f8af8ed783c8deb5df927a55c3951patch
- https://git.kernel.org/stable/c/cfcfa0ca0212162aa472551266038e8fd6768cffpatch
- https://git.kernel.org/stable/c/3eeddb80191f7626ec1ef742bfff51ec3b0fa5c2patch
- https://git.kernel.org/stable/c/4e8a0005d633a4adc98e3b65d5080f93b90d356bpatch
- https://git.kernel.org/stable/c/56145d237385ca0e7ca9ff7b226aaf2eb8ef368bpatch
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.