CVE-2026-90317

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. In sleepable BPF programs, a use-after-free vulnerability can occur due to improper handling of RCU (Read-Copy-Update) protected pointers after a spin unlock operation. A local attacker with limited capabilities could exploit this flaw to trigger a task_struct use-after-free, potentially leading to a denial of service or privilege escalation.

This vulnerability is rated as Moderate severity because exploitation requires local access with elevated privileges or capabilities, and successful exploitation relies on triggering a complex race condition. In standard Red Hat Enterprise Linux environments, loading sleepable tracing programs necessitates specific administrative capabilities such as CAP_BPF, significantly constraining the threat to authorized or container-scoped privileged operators. While an attacker with the required permissions could potentially cause kernel instability or elevate privileges, the issue cannot be triggered remotely or by unprivileged local users under default system configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.