Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to cause a system crash. The issue occurs when the system handles specific types of network traffic (UDP) while simultaneously updating network socket settings. This can lead to a 'use-after-free' scenario where the system tries to access memory that has already been deleted, resulting in a denial-of-service.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel's networking stack within the BPF subsystem. The root cause is that 'classic' BPF (cBPF) programs used in SO_REUSEPORT socket groups are freed immediately via sk_reuseport_prog_free() when detached or replaced, without waiting for an RCU grace period. If another thread is concurrently processing network packets (e.g., in reuseport_select_sock), it may attempt to access the already-freed program memory, leading to a vmalloc-out-of-bounds error or kernel splat. The fix defers the freeing of cBPF programs using call_rcu() to ensure all readers have completed. This issue primarily affects local attackers or specific race conditions during socket configuration.
Affected products
- Linux Linux Kernel All versions prior to the fix (e.g., 7.0.0-geb7ac95ff75e)
Timeline
- 2026-04-26: disclosed: Initial patch submitted by Kuniyuki Iwashima
- 2026-06-19: advisory: CVE-2026-52910 published
- 2026-06-19: patched: Commits merged into various stable branches
References
- https://git.kernel.org/stable/c/08264d5bba0bdd3a79bc2984fee09286aba0c4eb
- https://git.kernel.org/stable/c/18fc650ccd7fe3376eca89203668cfb8268f60df
- https://git.kernel.org/stable/c/298db6167f81e9c470a57cf652e4e47757b4293e
- https://git.kernel.org/stable/c/87dfb977bdb6eaa47e9993a34e18f44970f88b1f
- https://git.kernel.org/stable/c/90e47dc5c572d1c73971ac51c7428803f42b78eb
- https://git.kernel.org/stable/c/c3e3fddda6b5d9ba505d218b4055e7d8a282ac57
- https://git.kernel.org/stable/c/f8b8f1d4bb76098e87b8269a0631019648330e6d