Linux Kernel EUVD-2026-59326

The Linux kernel BPF subsystem allows BPF programs to be attached to cgroups for network and system call filtering. The BPF_F_PREORDER attachment flag alters execution ordering: compute_effective_progs() places BPF_F_PREORDER entries at the front of the effective program array (ancestor-cgroup first, then in attach order within a cgroup), with non-preorder entries following (descendant-cgroup first). The buggy replace_effective_prog() and purge_effective_progs() functions determined each program's position by linearly walking the hlist and counting entries, an ordering that only matches the array layout when no BPF_F_PREORDER programs are present. When they are present, the linear hlist count diverges from the actual array index. For replace_effective_prog() (invoked by bpf_link_update()), this overwrites the wrong array slot, silently corrupting cgroup BPF execution order. For purge_effective_progs(), it zeros a slot belonging to a different program and then calls bpf_prog_put() on the detached program, dropping its reference count to zero while a live pointer to it persists in the effective array - a kernel use-after-free (UAF). The fix introduces an effective_prog_pos() helper that replays compute_effective_progs() placement logic and identifies attachments by struct bpf_prog_list pointer rather than (prog, link) tuple, resolving ambiguity when the same bpf_prog is attached to multiple cgroups. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*. No CWE was formally assigned, but the root cause maps to CWE-416 (Use After Free) for the purge path and CWE-682 (Incorrect Calculation) for the index logic.