Linux kernel BPF: unprotected link->prog read races bpf_link_update into a use-after-free

Impact

bpf_link_show_fdinfo() and bpf_link_get_info_by_fd() dereference link->prog with no lock held. A concurrent bpf_link_update() can replace and free the old program, so reading the link's fdinfo or querying it via BPF_OBJ_GET_INFO_BY_FD can touch freed memory - a use-after-free in a path reachable from ordinary introspection, including anything that stats /proc/<pid>/fdinfo. The fix takes the pointer under RCU so its lifetime is guaranteed while its fields are read. The practical exposure on a GPU fleet is a local attacker who both holds a BPF link fd and can update it, or a monitoring agent that reads fdinfo while a controller rotates programs; the consequence is kernel memory corruption and a node that must be rebooted.

Who can reach it

Local, authenticated: a process holding a BPF link fd that can race BPF_LINK_UPDATE against an fdinfo read or info query on the same link. No remote path.

What to do

Patch to a stable kernel containing the listed commits and reboot. Mitigation in the meantime is access control, not configuration: keep BPF link creation and update rights to the control plane, and avoid handing CAP_BPF to tenants. No fixed distribution version is stated in the record.

References

Related entries

• Linux kernel RDMA/rxe: use-after-free when ODP memory-region registration failsCVE-2026-90423 · Linux kernel RDMA/rxe (soft-RoCE, on-demand paging MR init error path)High
• Linux vhost-scsi: stale response iovecs after a memory-table change write into unrelated memoryCVE-2026-93782 · Linux kernel vhost-scsi (VHOST_SET_MEM_TABLE vs in-flight command iovecs)High
• sudo: TZ from the calling user shifts NOTBEFORE/NOTAFTER windows, reviving expired rulesCVE-2026-96512 · sudo (NOTBEFORE/NOTAFTER sudoers time restrictions)High
• Linux slab allocator: ABA race in the optimistic freelist return corrupts the partial listCVE-2026-97941 · Linux kernel mm/slab (__slab_try_return_freelist ABA race)High
• Linux AMD IOMMU: sign-discarding error check lets nested domains use an unallocated domain IDCVE-2026-98002 · Linux kernel iommu/amd (amd_iommu_alloc_domain_nested error check)High
• Linux kernel RDMA/rxe: ODP write paths accept read-only pages, letting RDMA traffic overwrite the page cacheCVE-2026-98361 · Linux kernel RDMA/rxe (soft-RoCE on-demand paging write path)High