Executive brief
A vulnerability was identified in the Linux kernel's BPF (Berkeley Packet Filter) subsystem, which is used for high-performance networking and system monitoring. An error in how the system tracks the usage of certain internal data objects could allow a local attacker to cause a system crash or instability. This issue primarily affects the reliability and availability of the operating system.
Technical details
A use-after-free vulnerability exists in the Linux kernel BPF subsystem due to incorrect reference counting in the check_pseudo_btf_id() function. Specifically, the __check_pseudo_btf_id() function could be invoked with a BTF (BPF Type Format) object that has a reference count of zero, leading to premature deallocation. A local attacker with the ability to load BPF programs could exploit this flaw to trigger a kernel panic or potentially execute arbitrary code in kernel context, though the latter is significantly more complex. The issue was resolved by ensuring proper reference acquisition before object use and correcting the cleanup logic in __add_used_btf().
Affected products
- Linux Linux Kernel All versions prior to the fix in February 2026
Timeline
- 2026-02-09: patched: Initial fix authored by Anton Protopopov
- 2026-05-27: disclosed: CVE published in NVD