{"id":"CVE-2026-90393","summary":"bpf: Fix potential UAF in bpf_netns_link_update_prog","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix potential UAF in bpf_netns_link_update_prog\n\nIn bpf_netns_link_update_prog, the checks for old_prog and prog type\nare currently performed locklessly before acquiring netns_bpf_mutex.\nThis creates a race condition that can lead to a UAF issue.\n\nIf two threads concurrently execute BPF_LINK_UPDATE on the same netns\nlink, the following execution path can trigger a UAF:\n\nCPU0                                          CPU1\nbpf_netns_link_update_prog\n  if (old_prog && old_prog != link-\u003eprog)\n    return -EPERM;\n                                              bpf_netns_link_update_prog\n                                                if (old_prog && old_prog != link-\u003eprog)\n                                                ...\n                                                old_prog = xchg(&link-\u003eprog, new_prog);\n                                                bpf_prog_put(old_prog);\n  if (new_prog-\u003etype != link-\u003eprog-\u003etype) \u003c-- trigger UAF\n\nFix this by moving the old_prog and prog-\u003etype checks inside the\nnetns_bpf_mutex critical section. Meanwhile, use guard() to simplify\nlock management and avoid all the goto jumping.","modified":"2026-09-19T03:47:29.130963774Z","published":"2026-09-17T16:09:26.388Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90393.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/277168cb9d153ce8e9c3f9275670e32ae61b41d6"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5c5997836381010fc5907b36bc17d3b19407e933"},{"type":"WEB","url":"https://git.kernel.org/stable/c/79a66fd997d4eecf17302d613194879eb32e0986"},{"type":"WEB","url":"https://git.kernel.org/stable/c/923f559e95b89b33c7e1793b3d8f7f4ec9b2e4b7"},{"type":"WEB","url":"https://git.kernel.org/stable/c/bda86e9f31b9a296b6e64a51c91dc776fc9f613e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/bdddf3e1493ee973619c154a57071ce67f78598b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d462b5481d77ce7df8a5ff89a699386f00c9214d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f4ce6803df4095777191d800bebc50219b615ca0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90393.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90393"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"7f045a49fee04b5662cbdeaf0838f9322ae8c63a"},{"fixed":"d462b5481d77ce7df8a5ff89a699386f00c9214d"},{"fixed":"bdddf3e1493ee973619c154a57071ce67f78598b"},{"fixed":"79a66fd997d4eecf17302d613194879eb32e0986"},{"fixed":"f4ce6803df4095777191d800bebc50219b615ca0"},{"fixed":"277168cb9d153ce8e9c3f9275670e32ae61b41d6"},{"fixed":"bda86e9f31b9a296b6e64a51c91dc776fc9f613e"},{"fixed":"923f559e95b89b33c7e1793b3d8f7f4ec9b2e4b7"},{"fixed":"5c5997836381010fc5907b36bc17d3b19407e933"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90393.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.0"},{"fixed":"5.10.270"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.221"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.188"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.157"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.110"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.52"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90393.json"}}],"schema_version":"1.9.0"}