Executive brief
The Linux kernel's BPF (Berkeley Packet Filter) subsystem contains a use-after-free vulnerability in how it deallocates red-black tree root nodes. When a BPF red-black tree is freed, stale pointers in remaining refcounted objects can be reused if memory is reallocated, allowing an attacker to corrupt kernel data structures or execute arbitrary code within the kernel context.
Technical details
This is a use-after-free vulnerability in the bpf_rb_root_free() function within kernel/bpf/helpers.c. The root cause is improper cleanup of red-black tree node linkage when the root is deallocated. When bpf_rb_root_free() detaches a root and drops objects, refcounted objects that survive the drop retain stale rb_node state and owner pointers to the freed root. If a subsequent bpf_rb_root allocation reuses the same memory address, bpf_rbtree_remove() can incorrectly validate node ownership and call rb_erase_cached() on nodes with dangling tree pointers. The vulnerability requires local access to load and execute BPF programs. The fix marks nodes as poisoned during root detachment and clears node linkage before object deallocation, preventing subsequent misuse of the stale state.
Affected products
- Linux Linux kernel 5.8 and later before fix commit 4a7910ee060d8ce55612f5b3cc267f3a265a3cec
Timeline
- 2026-08-15: disclosed
- 2026-06-05: patched: Upstream fix commit 4a7910ee060d8ce55612f5b3cc267f3a265a3cec