Executive brief
The Linux kernel's BPF subsystem contains an index calculation flaw in cgroup program array management when preorder programs are attached. When updating or removing BPF programs from cgroup hierarchies, the kernel miscalculates array positions, leading to data corruption in program ordering or, in the worst case, use-after-free memory access. An attacker with CAP_SYS_ADMIN capability could trigger this vulnerability to corrupt kernel memory or cause a denial of service.
Technical details
The vulnerability exists in kernel/bpf/cgroup.c in the functions replace_effective_prog() and purge_effective_progs(). These functions locate program slots in the effective program array by walking the program hlist linearly and counting entries, but this count does not match the actual array layout. The compute_effective_progs() function places BPF_F_PREORDER programs at the front (ancestor cgroup first, then attachment order), while non-preorder programs follow (descendant cgroup first). When preorder programs are present, the hlist position diverges from the array index, causing replace_effective_prog() (called by bpf_link_update()) to corrupt the effective program order, and purge_effective_progs() to potentially create use-after-free scenarios. The fix introduces an effective_prog_pos() helper that replays the compute_effective_progs() placement logic, including per-cgroup preorder reversal, and identifies entries by struct bpf_prog_list pointer rather than (prog, link) value to ensure precise lookup. Exploitation requires capability to attach or modify BPF cgroup programs.
Affected products
- Linux Linux kernel 4.x, 5.x, 6.x, 7.x (affected versions prior to fix commit f08aaee3152d0dfc578b3f2586932d82062701dd)
Timeline
- 2026-08-15: disclosed: Advisory published
- 2026-06-18: patched: Fix committed upstream (Amery Hung)
- 2026-07-24: other: Backported to stable kernels