Linux Kernel EUVD-2026-59070

The vulnerability resides in the Linux kernel's io_uring subsystem, specifically the BPF struct_ops integration implemented in io_uring/bpf-ops. The io_install_bpf() function manages binding of BPF struct_ops maps to io_ring_ctx instances. The root cause is an asymmetric registration guard: the function checks ctx->bpf_ops on the context side but unconditionally overwrites the map-side back-pointer ops->priv on every call. Because the BPF struct_ops link path never advances a map past BPF_STRUCT_OPS_STATE_READY, the same io_uring_bpf_ops map object remains eligible for re-registration. A second BPF_LINK_CREATE call against a fresh io_ring_ctx passes the ctx->bpf_ops check (the new context has none), overwrites ops->priv, and orphans the first ctx. Teardown paths io_eject_bpf() and bpf_io_unreg() only reach a context through ops->priv, so the orphaned ctx is never cleaned up. Its ctx->loop_step remains pointing into the struct_ops trampoline, which is freed when the map is released. A subsequent io_uring_enter() on the orphaned ring dispatches through io_run_loop() into that dangling pointer - a use-after-free of freed executable memory. The CWE is listed as N/A in NVD input but is unambiguously CWE-416 (Use After Free) based on the technical description. Affected kernel versions span Linux 7.1 through pre-fix 7.1.x and 7.2-rc4, as documented by EUVD-2026-59070.