Skip to main content

Linux Kernel EUVDEUVD-2026-38957

| CVE-2026-53089 HIGH
Use After Free (CWE-416)
2026-06-24 Linux GHSA-fwh4-95hv-8xhf
Information Disclosure Linux Use After Free Memory Corruption
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
4.7 MEDIUM

Local race (AC:H) needing BPF privileges (PR:L); realistic impact is a UAF crash/DoS (A:H) with no demonstrated confidentiality or integrity disclosure, so C:N/I:N.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.1 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 23, 2026 - 18:38 vuln.today
CVSS changed
Jul 23, 2026 - 18:38 NVD
7.8 (HIGH)
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 16:30 nvd
HIGH 7.8

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix use-after-free in offloaded map/prog info fill

When querying info for an offloaded BPF map or program, bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns() obtain the network namespace with get_net(dev_net(offmap->netdev)). However, the associated netdev's netns may be racing with teardown during netns destruction. If the netns refcount has already reached 0, get_net() performs a refcount_t increment on 0, triggering:

refcount_t: addition on 0; use-after-free.

Although rtnl_lock and bpf_devs_lock ensure the netdev pointer remains valid, they cannot prevent the netns refcount from reaching zero.

Fix this by using maybe_get_net() instead of get_net(). maybe_get_net() uses refcount_inc_not_zero() and returns NULL if the refcount is already zero, which causes ns_get_path_cb() to fail and the caller to return -ENOENT -- the correct behavior when the netns is being destroyed.

AnalysisAI

Local privilege-adjacent memory corruption in the Linux kernel's BPF offload subsystem allows a use-after-free triggered when querying info for an offloaded BPF map or program while the associated network namespace is being torn down. The bug lives in bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns(), where get_net() increments a netns refcount that may already have reached zero, corrupting freed memory. No public exploit is identified at time of analysis, and EPSS is very low (0.14%), consistent with a hard-to-win kernel race rather than a broadly exploited flaw.

Technical ContextAI

The affected component is the BPF (Berkeley Packet Filter) hardware-offload path in the Linux kernel, which lets eBPF maps and programs be pushed onto SmartNIC/offload-capable netdevs. When userspace issues a BPF_OBJ_GET_INFO_BY_FD ioctl on an offloaded object, the kernel populates a netns file descriptor via get_net(dev_net(offmap->netdev)) and ns_get_path_cb(). CWE-416 (Use After Free) is the root-cause class: while rtnl_lock and bpf_devs_lock keep the netdev pointer itself valid, they do not pin the network namespace, so the netns refcount (refcount_t) can already be zero during net_namespace destruction. Calling get_net() then performs 'addition on 0', the kernel's canonical signal of operating on freed/dying object memory. The fix swaps get_net() for maybe_get_net(), which uses refcount_inc_not_zero() and returns NULL when the namespace is dying, propagating -ENOENT to the caller. Affected CPE is cpe:2.3:a:linux:linux:*, i.e. the mainline kernel; the flaw was introduced with BPF offload info-fill support (context around v4.16).

RemediationAI

Apply the upstream stable fix that replaces get_net() with maybe_get_net() in bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns(); the fix is available as stable commits a51e7fbe94a87e236631a83973d4f558310b2cd2 and a0c584fc18056709c8e047a82a6045d6c209f4ce (https://git.kernel.org/stable/c/a51e7fbe94a87e236631a83973d4f558310b2cd2 and https://git.kernel.org/stable/c/a0c584fc18056709c8e047a82a6045d6c209f4ce). Distribution users should update to the fixed kernel packages published in Ubuntu USN-8568-1 and USN-8566-1 and reboot. As a compensating control where patching must be deferred, avoid or disable BPF hardware offload on netdevs (do not load offloaded eBPF maps/programs, e.g. avoid tc/XDP offload to SmartNICs) since the vulnerable path is only reached for offloaded objects - the trade-off is loss of hardware-accelerated BPF processing. Restricting the CAP_BPF/CAP_SYS_ADMIN and CAP_NET_ADMIN capabilities and BPF syscall access to trusted users (e.g. via kernel.unprivileged_bpf_disabled) further reduces who can create offloaded objects and query their info, at the cost of constraining legitimate unprivileged BPF use.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-38957 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy