Linux kernel BPF: use-after-free when multi-attach trampoline update fails and the still-live old image is freed

Impact

When bpf_trampoline_update() fails before modify_fentry_multi() or unregister_fentry_multi() runs, cur_image still equals old_image and ftrace continues to call into it, yet the error path frees old_image anyway. ftrace then dispatches into freed executable memory - a use-after-free on a code page, which is among the most directly exploitable kernel corruption shapes. The exposure on a GPU fleet is through the tracing and observability stack: anything that attaches fentry/fexit multi programs (eBPF profilers, security agents, kprobe-based monitors) can hit the failing update path. NVD scores it local, low complexity, high on confidentiality, integrity and availability.

Who can reach it

Local user or agent able to attach BPF trampoline (fentry/fexit multi) programs, which requires CAP_BPF plus CAP_PERFMON or root. Not reachable from an unprivileged tenant pod; the attacker must be able to force the attach/update to fail.

What to do

Apply the stable kernel update that frees old_image only when it differs from cur_image (commits 0253073fb7d7, 65c3939656fd) and reboot each node. The code is in the built-in BPF core, so no module reload or live-patch route is published in the record. Interim mitigation is to restrict which workloads may attach fentry multi programs. No fixed release numbers appear in the record.

References

Related entries

• Linux kernel BPF verifier: iterator stack slots compared without pointer type, pruning an unsafe pathCVE-2026-90217 · Linux kernel BPF verifier (STACK_ITER slot type comparison during state pruning)High
• Linux kernel NVMe: SUBMIT_IO skips the command permission check, allowing writes through read-only handlesCVE-2026-90227 · Linux kernel NVMe ioctl (NVME_IOCTL_SUBMIT_IO missing nvme_cmd_allowed() check)High
• Linux kernel IOMMU DMA: unlocked msi_page_list corruption with two devices in one VFIO containerCVE-2026-90244 · Linux kernel iommu/dma (MSI page list locking under VFIO type1)High
• Linux kernel RDMA/siw: use-after-free in siw_accept() when the supplied QP is already in RTSCVE-2026-90292 · Linux kernel RDMA/siw (software iWARP, siw_accept() connection endpoint refcount)High
• Linux kernel RDMA/erdma: QP freed while async-event and CM handlers still use itCVE-2026-90308 · Linux kernel RDMA/erdma (QP lookup refcounting in AE and iWARP CM paths)High
• Linux kernel RDMA/erdma: completion queue freed while an in-flight EQ handler still references itCVE-2026-90309 · Linux kernel RDMA/erdma (CQ refcounting in EQ event handlers)High