Linux kernel BPF: use-after-free race in bpf_trampoline_link_cgroup_shim when attaching cgroup LSM programs

Impact

Attaching a cgroup-scoped BPF program can take a reference to a shim link whose refcount has already dropped to zero while its release is still pending. A racing process can then use freed kernel memory. The fix author reports a proof of concept that crashes almost every time. The CVSS vector rates it as full confidentiality, integrity and availability loss on the host kernel, so a crash takes down every job on the GPU node, and successful memory corruption would compromise every tenant on it.

Who can reach it

Local. A process on the host that can load and attach BPF programs (the cgroup LSM shim path) and can race attach and release. The record does not state which capabilities are needed. Normally only privileged agents such as CNI, observability or security daemons can attach BPF, so a container without BPF privileges should not reach this path.

What to do

Install a kernel that includes the stable fix (the commits referenced below), then drain and reboot each node. Until then, audit which pods and daemons hold BPF privileges (CAP_BPF / CAP_SYS_ADMIN, privileged containers) and keep them limited.

References

Related entries

• Linux kernel BPF devmap: XDP broadcast redirect writes past a stack array when a device has many uppersCVE-2026-23359 · Linux kernel BPF devmap (get_upper_ifindexes, XDP broadcast redirect excluded_devices array)High
• Linux kernel arm64 BPF JIT: misaligned PLT target can tear under concurrent text pokeCVE-2026-23383 · Linux kernel BPF JIT on arm64 (bpf_jit_binary_pack_alloc buffer alignment)High
• Linux kernel (drivers/iommu): Unbinding shared virtual addressing touches the mm's IOMMU state after the domain-freeCVE-2026-23429 · Linux kernel (drivers/iommu)High
• Linux kernel NFSD: reads on an open /proc/fs/nfs/exports fd walk a freed export cache after netns teardownCVE-2026-31403 · Linux kernel NFSD (/proc/fs/nfs/exports namespace reference)High
• Linux kernel (net/xfrm): Flushing xfrm states during namespace cleanup re-arms the NAT-keepalive delayed work after itCVE-2026-31406 · Linux kernel (net/xfrm)High
• Linux kernel (crypto algif_aead): Incorrect resource transfer between spheres in algif_aead (reverted to out-of-placeCVE-2026-31431 · Linux kernel (crypto algif_aead)High