CVE-2026-90392
HIGH
MEDIUM
Priority: 0.01
BB Relevance:
41/100
Published: 2026-09-17
Modified: 2026-10-30
First seen: 2026-10-30
Status: active
Attack Surface
Low Complexity
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
Low
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF when reading bpf link info In bpf_link_show_fdinfo and bpf_link_get_info_by_fd, link->prog is accessed without holding any locks. If the prog is concurrently replaced via bpf_link_update, the old prog can be freed, leading to a potential UAF issue. Fix this by accessing link->prog under RCU protection to safely fetch the pointer and guarantee its lifetime while reading its fields.
Affected Software (7)
| Vendor | Product | Version |
|---|---|---|
| Linux | Linux | 0c991ebc8c69d29b7fc44db17075c5aa5253e2ab < 4c8432a332d4a24dc2742f56062a53d8fad36f53 |
| Linux | Linux | 0c991ebc8c69d29b7fc44db17075c5aa5253e2ab < a5c936ac904767fc1d943d40b0308bcb2ae2509b |
| Linux | Linux | 0c991ebc8c69d29b7fc44db17075c5aa5253e2ab < d7d7208e2603b45724b684f4df73904fb347741e |
| Linux | Linux | 0c991ebc8c69d29b7fc44db17075c5aa5253e2ab < 85cf991c881e7198be32be05a9daa2625390c8b3 |
| Linux | Linux | 0c991ebc8c69d29b7fc44db17075c5aa5253e2ab < 79347e42cfbc9e78872922e8f08a70609c9af82f |
| Linux | Linux | 0c991ebc8c69d29b7fc44db17075c5aa5253e2ab < 863f3ddd0b8ac65abfb50d3be0869268ac0e277b |
| Linux | Linux | 5.7 |