Executive brief
The Linux kernel's eBPF (Berkeley Packet Filter) subsystem contains a resource management bug in its trampoline system used for dynamic kernel tracing. When attaching multiple tracing links in a specific sequence, the kernel fails to properly release resources, causing a memory leak and kernel warnings. This can degrade system stability and waste memory on systems using eBPF-based monitoring or security tools.
Technical details
The vulnerability is a resource leak in the BPF trampoline code (kernel/bpf/trampoline.c). When registering a multi-function entry trampoline via register_fentry_multi(), the code fails to set the ftrace_managed flag to true. This causes the tracing_multi link to not properly release its resources when subsequently attaching an fentry link, resulting in incomplete cleanup and a kernel warning in bpf_trampoline_multi_detach(). The fix is a one-line change setting tr->func.ftrace_managed = true in the register_fentry_multi() function. The vulnerability requires local access to load and attach BPF programs, which is typically restricted to privileged users.
Affected products
- Linux Linux kernel 5.8 and later (prior to fix commit 30bdd6d1384d894931f113eb595636092d8e650c)
Timeline
- 2026-09-17: disclosed: CVE-2026-93111 published
- 2026-07-11: patched: Fix committed upstream (commit 30bdd6d1384d894931f113eb595636092d8e650c)
- 2026-09-14: patched: Fix included in stable kernel release