Linux Kernel CVE-2026-93111

Requires local privileged access to the BPF subsystem (CAP_BPF or CAP_SYS_ADMIN) and a specific attach sequence: attaching a BPF tracing_multi (fentry-multi) link and then attaching an fentry link, after which releasing the link fails because register_fentry_multi() did not set ftrace_managed. Exploitation is limited by needing BPF privileges (not available to unprivileged users on hardened systems), local-only access (AV:L, no remote reachability), and use of the relatively new tracing_multi/fentry-multi feature; the observable effect is a kernel WARNING and mismanaged trampoline link rather than attacker-controlled corruption. No non-BPF default configuration is affected.

This is a high-CVSS-but-low-real-risk local kernel issue. The vendor CVSS 3.1 vector (7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) claims full confidentiality/integrity/availability impact, but the description does not support that: the bug is a missing 'ftrace_managed = true' flag in register_fentry_multi(), which causes the BPF tracing_multi link to fail to release, tripping a WARNING at kernel/bpf/trampoline.c:1727 in bpf_trampoline_multi_detach() during link teardown. That is a link-lifecycle/refcount management imbalance, not an attacker-controlled memory-disclosure or code-execution primitive, so the C:H/I:H rating appears overstated; realistic impact is availability-only (a WARN and a leaked/mismanaged trampoline link, at worst instability). No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so this is 'no public exploit identified at time of analysis'. SSVC-wise: exploitation none, automatable no, technical impact partial. Conflict to note: CVSS scores C:H/I:H/A:H while the described effect is a warning during link release triggered by a privileged BPF operation - verify impact with vendor; my independent read is roughly 3.5-4.5. CWE is listed as N/A. A patch is available.

A local user with BPF privileges (CAP_BPF/CAP_SYS_ADMIN) loads a BPF program, attaches it via a tracing_multi (fentry-multi) link, then attaches an fentry link over the same target; on teardown the tracing_multi link is not recognized as ftrace-managed and fails to release, tripping the kernel WARNING and leaving trampoline state inconsistent. No public proof-of-concept is referenced. Exploitation is purely local and requires the privileged BPF attach path, so it is not remotely reachable and not a widespread threat.