CVE-2026-90317

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description In sleepable BPF programs, a spin lock may serve as the sole RCU (Read-Copy-Update) protection for a kptr. The bpf spin unlock() function ends this protection, but the verifier incorrectly maintains the pointer as valid. This allows another CPU to free the object before the pointer is accessed, potentially leading to a use-after-free condition. This was demonstrated via a proof-of-concept that triggered a task struct use-after-free within the bpf get task stack() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.