Executive brief
The Linux kernel's BPF (Berkeley Packet Filter) subsystem contains a use-after-free vulnerability in reference counting logic for non-owning references. This affects systems running the kernel with BPF enabled. An attacker with privileges to load and run BPF programs could trigger a use-after-free condition, potentially leading to kernel crash, privilege escalation, or arbitrary code execution.
Technical details
The vulnerability exists in the bpf_refcount_acquire function, which failed to account for scenarios where a non-owning reference might have its refcount decremented to zero by concurrent operations (particularly after a failed rbtree_add or list_push operation). The original implementation used refcount_inc on a potentially zero refcount, violating refcount semantics. The fix changes bpf_refcount_acquire to use refcount_inc_not_zero (returning NULL on failure) and adds verifier bookkeeping to distinguish owning vs. non-owning references, allowing fallible behavior only for non-owning refs. Attack requires BPF program loading capability (typically root or CAP_BPF) and a careful race condition between reference operations within a spin-lock context. The fix is incorporated in the mainline kernel and available via patched versions.
Affected products
- Linux Linux kernel Linux 6.3 and earlier versions with BPF subsystem
Timeline
- 2025-10-07: disclosed
- patched: Fix incorporated in mainline kernel via bpf refcount changes