Linux kernel SO_REUSEPORT: cBPF program freed without an RCU grace period, use-after-free in UDP receive

Impact

When a classic-BPF program attached to a SO_REUSEPORT socket group is replaced or detached via setsockopt, sk_reuseport_prog_free() frees it immediately through bpf_release_orig_filter() and bpf_prog_free(), without waiting for RCU readers to finish. A concurrent packet arriving for the same reuseport group makes reuseport_select_sock() read the freed program, which the reporter captured as a KASAN vmalloc out-of-bounds read in the softirq receive path. eBPF programs are safe here because bpf_prog_put() defers destruction; only the cBPF path frees early. On a GPU node the practical consequence is a kernel use-after-free reachable by a local process that can hold a reuseport socket group and swap its cBPF filter while traffic flows - a node-level crash at minimum, with the usual uncertainty about how far a use-after-free in the receive path can be pushed. Attaching a cBPF filter with SO_ATTACH_REUSEPORT_CBPF does not need elevated privileges, so a tenant process with host networking or a network namespace of its own is inside the reachable set.

Who can reach it

A local process that can create a UDP (or TCP) SO_REUSEPORT group, attach a cBPF program with SO_ATTACH_REUSEPORT_CBPF, and replace or detach it while packets are being delivered to the group. Local authenticated access is required; no CAP_BPF or root, and the traffic can be self-generated from the same host.

What to do

Update to a stable kernel that defers the reuseport cBPF free by one RCU grace period and reboot each node - drain and reboot per GPU host; there is no sysctl or module option that turns the path off. As an interim narrowing, keep tenants out of host networking and off privileged network namespaces where they can hold reuseport groups, but note that does not remove the flaw for any service on the node that legitimately uses reuseport with cBPF.

References

Related entries

• Linux kernel io_uring poll: cancel flag makes the ownership slowpath unreachableCVE-2026-52933 · Linux kernel io_uring (io_poll_get_ownership signed refcount comparison)High
• Linux kernel (net/xfrm): ESP-in-TCP keeps a single in-flight transmit. For a blocking caller the flush of that stateCVE-2026-52935 · Linux kernel (net/xfrm)High
• Linux kernel PSI: use-after-free racing a cgroup pressure write against cgroup removalCVE-2026-52991 · Linux kernel sched/psi (cgroup pressure files)High
• Linux kernel ccp driver: IV restore overruns the 8-byte RFC3686 IV bufferCVE-2026-53016 · Linux kernel crypto/ccp (AMD Cryptographic Coprocessor, RFC3686 CTR-AES)High
• Linux BPF offload: refcount increment on a dying netns causes use-after-free during info queryCVE-2026-53089 · Linux kernel BPF offload (bpf_map/prog_offload_info_fill_ns netns refcount)High
• Linux kernel BPF verifier: ld_abs/ld_ind failure path left unverified inside subprogramsCVE-2026-53090 · Linux kernel BPF verifier (ld_abs/ld_ind in subprograms)High