Executive brief
The Linux kernel's Berkeley Packet Filter (BPF) subsystem has a flaw in cgroup attachment logic that can leave stale memory references when a program replacement operation fails midway through. When an administrator attempts to replace a running BPF program with a new one and the operation fails partway, the kernel incorrectly leaves the old program pointing to freed or invalid memory structures. This causes the previously-running program to crash or behave unpredictably when it next executes, potentially destabilizing system performance or causing denial of service.
Technical details
The vulnerability exists in the BPF cgroup attachment code (kernel/bpf/cgroup.c, function __cgroup_bpf_attach). When replacing a BPF program with BPF_F_REPLACE flag in multi-attach mode, the function updates internal storage pointers and flags before confirming the entire operation succeeds. If the attachment fails midway (e.g., in bpf_trampoline_link_cgroup_shim or update_effective_progs), the error path frees the newly-allocated storage but fails to restore the original storage pointers and flags. This leaves an active BPF program holding dangling pointers that will be dereferenced when the program calls bpf_get_local_storage, causing an invalid memory access. The fix saves old_storage, old_pl_flags, and old_flags prior to modification and properly restores all three in the error cleanup path. Patch availability: fixes committed upstream and backported to stable kernel versions.
Affected products
- Linux Linux kernel multiple versions (patch applied across stable branches 4.19.y through 7.0.y and later)
Timeline
- 2026-09-17: disclosed: CVE-2026-90313 published
- 2026-08-04: patched: upstream patch merged by Andrii Nakryiko
- 2026-09-14: patched: patch applied to stable trees