Linux kernel BPF verifier: kptrs stay valid after the final spin unlock ends RCU protection

Impact

In a sleepable BPF program a bpf_spin_lock can be the only RCU protection covering a kptr. The final bpf_spin_unlock() ends that protection, but the verifier continues to treat the pointer as valid, so another CPU can free the object before the program dereferences it. The record states a capability-limited runtime proof of concept triggered a task_struct use-after-free in __bpf_get_task_stack(), which makes this a demonstrated local escalation primitive rather than a theoretical one, scored 7.8 with full confidentiality, integrity and availability loss. On a shared GPU cluster the exposed surface is every agent allowed to load sleepable BPF - tracing, security and networking daemons - and recovery from a corrupted task_struct is a node reboot.

Who can reach it

Local: a context that can load a sleepable BPF program using kptrs and bpf_spin_lock. The record describes the proof of concept as capability-limited, i.e. it does not require full root, but node access and BPF load rights are needed. No remote vector.

What to do

Move to a stable kernel with the listed commits and reboot the affected nodes. In the interim, limit BPF program loading: unprivileged BPF off, CAP_BPF withheld from tenant workloads, and audit which cluster agents load sleepable programs. No fixed vendor release is given.

References

Related entries

• Linux kernel bpf x86: trampoline under-allocates the save area for __int128 argumentsCVE-2026-90358 · Linux kernel BPF x86 JIT (trampoline register save area for 128-bit arguments)High
• Linux kernel IOMMU DMA: allocation failure not detected in the non-blocking non-coherent pathCVE-2026-90388 · Linux kernel iommu/dma (atomic pool allocation failure check in the non-coherent path)High
• Linux kernel BPF: unprotected link->prog read races bpf_link_update into a use-after-freeCVE-2026-90392 · Linux kernel BPF link info (bpf_link_show_fdinfo / bpf_link_get_info_by_fd prog access)High
• Linux kernel RDMA/rxe: use-after-free when ODP memory-region registration failsCVE-2026-90423 · Linux kernel RDMA/rxe (soft-RoCE, on-demand paging MR init error path)High
• Linux vhost-scsi: stale response iovecs after a memory-table change write into unrelated memoryCVE-2026-93782 · Linux kernel vhost-scsi (VHOST_SET_MEM_TABLE vs in-flight command iovecs)High
• sudo: TZ from the calling user shifts NOTBEFORE/NOTAFTER windows, reviving expired rulesCVE-2026-96512 · sudo (NOTBEFORE/NOTAFTER sudoers time restrictions)High