Linux BPF: link iterator takes a reference to an unsettled link, leading to use-after-free

Impact

bpf_link_prime() publishes a link in link_idr before bpf_link_settle() assigns its ID. bpf_link_by_id() skips such ID-zero entries, but the BPF link iterator did not: it took a reference anyway. If anon_inode_getfile() then fails, the creator frees the still-private link and the iterator is left holding a dangling pointer, so its next bpf_link_put() writes to freed memory - KASAN slab-use-after-free, with a kernel panic in the reported trace and the usual escalation potential that comes with a controlled write to a freed slab object. On GPU nodes this matters because BPF is not exotic infrastructure there: Cilium, observability agents and seccomp/LSM tooling all create BPF links, and a crashed or compromised kernel on an accelerator node is the expensive kind of outage.

Who can reach it

Local. The attacker needs to be able to both create BPF links and read the BPF link iterator, which in practice means CAP_BPF/CAP_SYS_ADMIN in the init namespace - not something an ordinary GPU pod has unless it was granted privileged capabilities or host BPF access. The race also needs anon_inode_getfile() to fail, typically forced via fd pressure.

What to do

Update to a stable kernel containing the fix (commits linked in the record); kernel updates mean drain and reboot each node. Until then, the realistic mitigation is to stop granting CAP_BPF/CAP_SYS_ADMIN to tenant workloads and to audit which DaemonSets run with host BPF access.

References

Related entries

• Linux BPF: dev-bound-only program can attach to a sibling netdev and run driver-specific kfuncsCVE-2026-98382 · Linux kernel BPF offload matching (__bpf_offload_dev_match, dev-bound programs)Unscored
• Linux BPF: LWT_SEG6LOCAL program can leave a dangling SRH pointer via bpf_skb_pull_data()CVE-2026-98383 · Linux kernel BPF LWT_SEG6LOCAL (bpf_skb_pull_data with cached SRH)Unscored
• Linux BPF: bpf_sock_destroy() reads sk_protocol out of bounds on timewait and request socketsCVE-2026-98384 · Linux kernel bpf_sock_destroy() (sk_protocol read on timewait/request socks)Unscored
• Linux kernel sched/cache: use-after-free on mm_struct when a task switches address space during account_mm_sched()CVE-2026-98385 · Linux kernel scheduler (sched/cache, sched_cache_stat in mm_struct)Unscored
• ProFTPD mod_copy: unauthenticated SITE CPFR/CPTO gives arbitrary file read and writeCVE-2015-3306 · ProFTPD mod_copy (SITE CPFR / SITE CPTO)Critical
• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical