{"id":"AZL-101897","summary":"CVE-2026-90393 affecting package kernel 6.6.150.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix potential UAF in bpf_netns_link_update_prog\n\nIn bpf_netns_link_update_prog, the checks for old_prog and prog type\nare currently performed locklessly before acquiring netns_bpf_mutex.\nThis creates a race condition that can lead to a UAF issue.\n\nIf two threads concurrently execute BPF_LINK_UPDATE on the same netns\nlink, the following execution path can trigger a UAF:\n\nCPU0                                          CPU1\nbpf_netns_link_update_prog\n  if (old_prog && old_prog != link-\u003eprog)\n    return -EPERM;\n                                              bpf_netns_link_update_prog\n                                                if (old_prog && old_prog != link-\u003eprog)\n                                                ...\n                                                old_prog = xchg(&link-\u003eprog, new_prog);\n                                                bpf_prog_put(old_prog);\n  if (new_prog-\u003etype != link-\u003eprog-\u003etype) \u003c-- trigger UAF\n\nFix this by moving the old_prog and prog-\u003etype checks inside the\nnetns_bpf_mutex critical section. Meanwhile, use guard() to simplify\nlock management and avoid all the goto jumping.","modified":"2026-09-19T05:33:49Z","published":"2026-09-17T17:17:38Z","upstream":["CVE-2026-90393"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90393"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.150.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-101897.json"}}],"schema_version":"1.9.0"}