Linux kernel BPF: stale rbtree node linkage after bpf_rb_root_free allows erase on a freed root

Impact

bpf_rb_root_free() detached the root and dropped the contained objects without clearing each node's rb linkage or owner pointer. A refcounted object that survives the drop keeps an owner pointer into the freed root and stale rb pointers; if a later bpf_rb_root allocation lands on the same address, bpf_rbtree_remove() passes the owner check and calls rb_erase_cached() on a node whose links belong to the dead tree. That is attacker-influenced kernel memory corruption reachable from a loaded BPF program using rbtree collection kfuncs - the usual path from there is local privilege escalation on the host, which on a shared GPU node means escape from whatever the BPF loader was confined to.

Who can reach it

Local, requires the ability to load BPF programs that use rbtree collections (CAP_BPF/CAP_SYS_ADMIN). Not reachable from an unprivileged tenant workload unless BPF loading has been delegated to it.

What to do

Install a stable kernel with the fix that marks nodes busy while the root is detached and clears node linkage and owner before dropping the object (backported across stable branches; see the linked commits for the release on yours), then drain and reboot the node. No vendor-published mitigation beyond keeping BPF loading privileged.

References

Related entries

• Linux kernel BPF: BPF_PROG_QUERY writes the revision field past a short bpf_attr from userspaceCVE-2026-74371 · Linux kernel BPF BPF_PROG_QUERY (cgroup query revision write-back)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A race condition or locking defect in the amdkfd (KFDCVE-2026-74446 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-74447 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel THP split: use-after-free on the inode when memory-failure splits a shmem huge pageCVE-2026-74482 · Linux kernel mm/huge_memory (__folio_split i_mmap_rwsem release order)High
• Linux kernel hugetlbfs: list corruption in reservation top-up can link a kernel-stack address into MM stateCVE-2026-74518 · Linux kernel hugetlbfs reservation map (allocate_file_region_entries)High
• Linux kernel (net/rds): Bind() on an RDS socket with a scoped IPv6 address looks up the interface under RCU, drops theCVE-2026-74563 · Linux kernel (net/rds)High