CVE-2026-90392

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. A local attacker could exploit a Use-After-Free (UAF) vulnerability by concurrently replacing a BPF program while its information is being read without proper locking. This could allow the attacker to achieve privilege escalation or cause a denial of service.

A use-after-free can occur in the BPF link information path because bpf_link_show_fdinfo() and bpf_link_get_info_by_fd() read the link prog pointer without RCU lifetime protection while another thread can replace it through bpf_link_update. A local process can race reading fdinfo or BPF link info against program replacement, causing stale bpf_prog fields such as tag or aux id to be read after the old program was freed. For the CVSS the PR:L is selected because triggering requires a local user context with access to BPF link file descriptors or delegated BPF capabilities, but not necessarily full administrative control in all deployments. The issue is not network reachable and is triggered through local BPF control plane operations. Impact is at least local denial of service via kernel crash and may include limited confidentiality impact through stale kernel object reads.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.