CVE-2026-90313

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) cgroup functionality. This issue arises during the replacement of a cgroup BPF program in multi-attach mode. If the replacement process fails, the system may not correctly restore the original program's storage pointers, leaving them in an invalid or dangling state. This can lead to an invalid memory access when the affected program attempts to use its local storage, potentially causing system instability or a denial of service.

An invalid storage access in cgroup BPF can occur after a failed BPF_F_REPLACE operation in multi attach mode because pl storage is updated before attach completion and is not restored on the error path. The still active old program can keep a dangling cgroup storage pointer after the newly allocated storage has been freed, and a later bpf_get_local_storage call may dereference or use that stale storage. For the CVSS the PR:L is used for the paranoid score because reliable triggering requires local ability to attach or replace cgroup BPF programs, but this may be delegated to a service account or container root rather than full host root. The issue is not network reachable and must be triggered through local BPF and cgroup control plane operations. Impact is at least local denial of service via invalid memory access and in the worst case may allow confidentiality or integrity impact due to a use after free style dangling pointer in kernel memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.