Linux Kernel EUVD-2026-81803

Requires local access with the ability to load and multi-attach BPF fentry trampolines, which in practice needs CAP_BPF and/or CAP_SYS_ADMIN. The attacker must also cause bpf_trampoline_update() to fail on the specific error path where the update aborts before modify_fentry_multi()/unregister_fentry_multi() runs, leaving cur_image==old_image so the erroneous free triggers. Limiting factors: exploitation is confined to kernels that ship the new BPF trampoline multi-attach (fentry_multi) code (7.2.x and 7.3-rc series), needs privileged BPF capability, and depends on hitting an error/failure corner rather than a normal success path - so it is not remotely reachable and not exploitable against default unprivileged users.

This is a use-after-free (CWE-416) in the Linux kernel BPF trampoline multi-attach teardown path, reported by Linux with a vendor CVSS3.1 of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Signals point to a LOW real-world priority despite the high base score: there is no EPSS score, no CISA KEV listing, and no public exploit identified - the only references are the two kernel.org stable commits and an NVD mirror, meaning this is a routine coordinated kernel fix with no exploitation evidence. The vendor vector is also optimistic on several axes. It rates C:H/I:H/A:H, but the resolved-description is a UAF that arises specifically when bpf_trampoline_update() fails on an error path (before modify_fentry_multi()/unregister_fentry_multi()) - this is crash-primary DoS behavior, and full confidentiality/integrity compromise via this freed image is not substantiated by the description. The vector's AC:L understates the difficulty: the attacker must force bpf_trampoline_update() to fail at the right moment to leave cur_image==old_image, which is an error-path corner, not a straight-line trigger. PR:L also understates reality - BPF trampoline/fentry multi-attach requires CAP_BPF/CAP_SYS_ADMIN, so this is effectively a privileged local operation. Net: a legitimate memory-safety bug worth patching on affected 7.2.x/7.3-rc kernels, but not an urgent widespread-exploitation risk.

A local user with BPF privileges (CAP_BPF/CAP_SYS_ADMIN) attaches a multi-attach fentry BPF trampoline and drives a program update that fails inside bpf_trampoline_update() before the fentry image is modified or unregistered. Because cur_image still equals old_image and ftrace continues calling into it, the subsequent free of old_image produces a use-after-free that most reliably crashes the kernel (DoS). No public proof-of-concept exists at time of analysis.