CVE-2026-53089

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists when querying information for an offloaded BPF map or program. The functions bpf map offload info fill ns() and bpf prog offload info fill ns() use get net(dev net(offmap->netdev)) to obtain the network namespace. A race condition can occur during network namespace destruction where the reference count reaches zero. In such cases, get net() attempts to increment a zero reference count, leading to a use-after-free condition. While rtnl lock and bpf devs lock maintain the validity of the netdev pointer, they do not prevent the reference count from reaching zero.

Recommendations Update the Linux kernel to a version where get net() is replaced by maybe get net() in the affected functions to ensure the reference count is not zero before incrementing.