Executive brief
The Linux kernel's eBPF subsystem contains a use-after-free (UAF) vulnerability when reading BPF link information. An attacker with local access can trigger a race condition that causes the kernel to access freed memory, potentially leading to information disclosure or denial of service through system crashes.
Technical details
The vulnerability is a use-after-free in the bpf_link_show_fdinfo() and bpf_link_get_info_by_fd() functions in kernel/bpf/syscall.c. These functions access the link->prog pointer without holding RCU locks. If a concurrent bpf_link_update() call replaces the BPF program and frees the old program, the reading functions will access freed memory. The fix adds RCU protection (rcu_read_lock/rcu_read_unlock) and uses READ_ONCE() to safely fetch and use the link->prog pointer. Attack requires local access to trigger concurrent operations. Patch is available in upstream kernel.
Affected products
- Linux Linux kernel kernel versions prior to fix commit 863f3ddd0b8ac65abfb50d3be0869268ac0e277b
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched