CVE-2026-90317bpf: Invalidate RCU pointers after final spin unlock
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: bpf: Invalidate RCU pointers after final spin unlock In a sleepable BPF program, a spin lock can provide the only RCU protection for a kptr. The final bpf_spin_unlock() ends that protection, but the verifier leaves the pointer valid. Another CPU can then free the object before the pointer is used. A capability-limited runtime PoC triggered a task_struct use-after-free in __bpf_get_task_stack(). Record whether the program is in an RCU-protected context before releasing the lock. Invalidate RCU-protected pointers only when the unlock leaves the final such context. This preserves valid pointers in non-sleepable programs and inside an explicit RCU read-side section.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 5861d1e8dbc4e1a03ebffb96ac041026cdd34c07 before f81972b235f3ebfa40bdce8bcfee3f242fb24065; 5861d1e8dbc4e1a03ebffb96ac041026cdd34c07 builds before 7ae71629357d0a6d0bdadb929c7b296d5b7e61c2; 5861d1e8dbc4e1a03ebffb96ac041026cdd34c07 builds before 180c7000712db77063b3a26f4c97e7dd9038f449 | CNA record |
References
- https://git.kernel.org/stable/c/f81972b235f3ebfa40bdce8bcfee3f242fb24065
- https://git.kernel.org/stable/c/7ae71629357d0a6d0bdadb929c7b296d5b7e61c2
- https://git.kernel.org/stable/c/180c7000712db77063b3a26f4c97e7dd9038f449
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.