Linux Kernel CVE-2026-90317

Requires the ability to load and run sleepable BPF programs, which needs CAP_BPF (unprivileged BPF is disabled by default on most current distributions), so it is a local, privileged-foothold bug rather than remote. The specific trigger is a sleepable program where a bpf_spin_lock provides the sole RCU protection for a kptr and the pointer is used after the final bpf_spin_unlock(); non-sleepable programs and code inside an explicit RCU read-side section are not affected. Reliable exploitation additionally requires winning a cross-CPU race to free and reallocate the object (heap grooming) within the window, which limits ease of exploitation despite the powerful task_struct UAF primitive.

This is a genuine local privilege-escalation primitive, not a mere crash bug. The BPF verifier fails to invalidate an RCU-protected kernel pointer (kptr) after the final bpf_spin_unlock() in a sleepable program, where that spin lock was the only source of RCU protection; the object can then be freed on another CPU while the pointer remains usable, and the report explicitly demonstrates a task_struct use-after-free in __bpf_get_task_stack(). A task_struct UAF is a classic, highly controllable path to overwriting credentials and achieving root, so the vendor's C:H/I:H/A:H impact is justified - unlike many kernel UAFs that are crash-only. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U, 7.8) is largely defensible, but AC:L understates the cross-CPU free race that must be won; I assess AC:H, yielding ~7.0. PR:L is appropriate because loading and running sleepable BPF programs requires CAP_BPF (and unprivileged BPF is disabled by default on most modern distros), so this is not attacker-reachable without a foothold and BPF capability. No EPSS, no CISA KEV entry, and no public exploit - the description references a private 'capability-limited runtime PoC' held by the reporter, which is not the same as public exploit code or active exploitation. Net: a real, high-value local escalation bug worth prompt patching on any host exposing BPF to semi-trusted workloads, but its reach is bounded by the CAP_BPF requirement and the specific sleepable-program feature combination.

An attacker with CAP_BPF (or in a container/runtime granted BPF load rights) loads a sleepable BPF program that stashes a task_struct kptr protected only by a bpf_spin_lock, releases the lock, and then races another CPU to free the object while the stale pointer is still used by __bpf_get_task_stack(). By grooming the freed slab and reallocating it with attacker-controlled data, the UAF is converted into arbitrary kernel read/write and credential overwrite for local privilege escalation. A private capability-limited PoC is reported to trigger the task_struct UAF, but no public exploit code was identified at time of analysis.