Executive brief
The Linux kernel's eBPF subsystem contains a use-after-free vulnerability in the BPF trampoline attachment mechanism. When a trampoline update operation fails partway through, stale memory can be freed while still being accessed by the kernel's ftrace module, potentially causing system crashes or allowing privilege escalation. This affects systems using eBPF (a technology for running sandboxed programs in the kernel) with multi-attach trampolines.
Technical details
The vulnerability is a use-after-free (UAF) in the bpf_trampoline_multi_attach_free() function in kernel/bpf/trampoline.c. When bpf_trampoline_update() fails before the modify_fentry_multi() or unregister_fentry_multi() functions are called, the cur_image pointer remains unchanged (cur_image == old_image) while ftrace continues to reference it. The vulnerable code unconditionally frees old_image without checking if it's still the active image, causing a UAF when ftrace later calls into the freed memory. The fix adds a conditional check to only free old_image when it differs from cur_image, ensuring stale images are freed only after they're no longer in use. The vulnerability affects Linux kernels in versions 4.x through 7.x that have the multi-attach BPF trampoline feature enabled.
Affected products
- Linux Linux kernel 4.0 and later (affected by the introduced feature; patch available)
Timeline
- 2026-09-17: disclosed: CVE-2026-90210 published
- 2026-08-13: patched: Fix committed upstream (0253073fb7d79a2dd2eae9581ea16db2aef395a6)
- 2026-09-14: patched: Fix backported to stable kernels (65c3939656fd7848e9274faa07c26748b5bf049c)