CVE-2026-90393bpf: Fix potential UAF in bpf_netns_link_update_prog
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF in bpf_netns_link_update_prog In bpf_netns_link_update_prog, the checks for old_prog and prog type are currently performed locklessly before acquiring netns_bpf_mutex. This creates a race condition that can lead to a UAF issue. If two threads concurrently execute BPF_LINK_UPDATE on the same netns link, the following execution path can trigger a UAF: CPU0 CPU1 bpf_netns_link_update_prog if (old_prog && old_prog != link->prog) return -EPERM; bpf_netns_link_update_prog if (old_prog && old_prog != link->prog) ... old_prog = xchg(&link->prog, new_prog); bpf_prog_put(old_prog); if (new_prog->type != link->prog->type) <-- trigger UAF Fix this by moving the old_prog and prog->type checks inside the netns_bpf_mutex critical section. Meanwhile, use guard() to simplify lock management and avoid all the goto jumping.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 7f045a49fee04b5662cbdeaf0838f9322ae8c63a before d462b5481d77ce7df8a5ff89a699386f00c9214d; from 7f045a49fee04b5662cbdeaf0838f9322ae8c63a before bdddf3e1493ee973619c154a57071ce67f78598b; from 7f045a49fee04b5662cbdeaf0838f9322ae8c63a before 79a66fd997d4eecf17302d613194879eb32e0986; from 7f045a49fee04b5662cbdeaf0838f9322ae8c63a before f4ce6803df4095777191d800bebc50219b615ca0; from 7f045a49fee04b5662cbdeaf0838f9322ae8c63a before 277168cb9d153ce8e9c3f9275670e32ae61b41d6; from 7f045a49fee04b5662cbdeaf0838f9322ae8c63a before bda86e9f31b9a296b6e64a51c91dc776fc9f613e; from 7f045a49fee04b5662cbdeaf0838f9322ae8c63a before 923f559e95b89b33c7e1793b3d8f7f4ec9b2e4b7; 7f045a49fee04b5662cbdeaf0838f9322ae8c63a builds before 5c5997836381010fc5907b36bc17d3b19407e933 | CNA record |
References
- https://git.kernel.org/stable/c/d462b5481d77ce7df8a5ff89a699386f00c9214d
- https://git.kernel.org/stable/c/bdddf3e1493ee973619c154a57071ce67f78598b
- https://git.kernel.org/stable/c/79a66fd997d4eecf17302d613194879eb32e0986
- https://git.kernel.org/stable/c/f4ce6803df4095777191d800bebc50219b615ca0
- https://git.kernel.org/stable/c/277168cb9d153ce8e9c3f9275670e32ae61b41d6
- https://git.kernel.org/stable/c/bda86e9f31b9a296b6e64a51c91dc776fc9f613e
- https://git.kernel.org/stable/c/923f559e95b89b33c7e1793b3d8f7f4ec9b2e4b7
- https://git.kernel.org/stable/c/5c5997836381010fc5907b36bc17d3b19407e933
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.