CVE-2026-90393

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) component. This vulnerability arises from a race condition in the bpf_netns_link_update_prog function, where checks are performed without proper locking. A local attacker could exploit this to trigger a Use-After-Free (UAF) condition, potentially leading to memory corruption and system instability or privilege escalation.

A race in bpf_netns_link_update_prog can happen when two threads concurrently execute BPF_LINK_UPDATE on the same network namespace BPF link. The old_prog and program type checks were done before taking netns_bpf_mutex, so one thread can replace link prog and drop the old bpf_prog reference while another thread still evaluates the lockless type check. This creates a potential use after free in the BPF link update path. For the CVSS the PR:L is used because a local user or process must be able to update a BPF netns link, typically through BPF link update access or delegated network/BPF capabilities. The issue is not directly network reachable. Impact is at least local denial of service via kernel crash and in the paranoid case may include confidentiality and integrity impact because the bug class is UAF in kernel memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.