CVE-2026-90210

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-90210", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.793Z", "datePublished": "2026-09-17T16:07:24.772Z", "dateUpdated": "2026-10-19T08:59:46.406Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T08:59:46.406Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix UAF in bpf_trampoline_multi_attach_free on update failure\n\nWhen bpf_trampoline_update() fails before modify_fentry_multi()/\nunregister_fentry_multi() is called, cur_image is unchanged\n(cur_image == old_image) and ftrace still calls into it. Freeing\nold_image in that case causes a UAF.\n\nOnly free old_image when it differs from cur_image."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The UAF is reached only via the local bpf() syscall: BPF_PROG_LOAD of BPF_PROG_TYPE_TRACING with BPF_TRACE_FENTRY_MULTI/FEXIT_MULTI/FSESSION_MULTI, BPF_LINK_CREATE into bpf_tracing_multi_attach(), then close() of that link fd which runs bpf_tracing_multi_link_release() -> bpf_trampoline_multi_detach() -> bpf_trampoline_multi_attach_free().\nAC:L - The attacker attaches a second fentry program on the same ftrace-managed function so detach rebuilds the trampoline, then closes the multi-link fd. bpf_trampoline_multi_detach() WARN_ON_ONCE-ignores bpf_trampoline_update() failure before modify_fentry_multi() and still calls bpf_trampoline_multi_attach_free(); ENOMEM from bpf_tramp_image_alloc() or arch_prepare_bpf_trampoline() is inducible by exhausting bpf_prog_pack from that process.\nPR:L - bpf_prog_load() requires bpf_token_capable(CAP_BPF) and bpf_token_capable(CAP_PERFMON) for BPF_PROG_TYPE_TRACING. bpf_token_capable() calls ns_capable() on a delegated BPF token's user namespace, so a container user with a token (or a non-root tracing daemon holding only those two caps) can load and attach fentry.multi without host root.\nUI:N - The attacker loads the tracing programs, creates the tracing-multi link with BPF_LINK_CREATE, and closes their own link fd to hit bpf_trampoline_multi_attach_free(); no other user must mount, open a file, or otherwise act.\nS:U - The UAF of bpf_tramp_image and its JIT text, and any resulting kernel control-flow hijack, remain inside the host kernel; this is a standard kernel privilege-escalation defect, not a VM escape or IOMMU/guest boundary crossing.\nC:H - On the failing detach path bpf_trampoline_multi_attach_free() calls bpf_tramp_image_put() while ftrace still direct-calls that image (old_image == cur_image). After the RCU tasks-trace GP, bpf_prog_pack_free() returns those pages; reclaiming them exposes kernel/JIT contents and yields an arbitrary-read primitive.\nI:H - ftrace keeps a direct call into the trampoline that bpf_tramp_image_put() is freeing. Reclaiming the bpf_prog_pack pages with attacker-controlled BPF JIT text makes the next call of the traced function jump to chosen kernel instructions, i.e. control-flow hijack and arbitrary write.\nA:H - After bpf_tramp_image_put() of a trampoline that ftrace still invokes, the next entry to the attached kernel function jumps into freed executable memory and oopses/panics. Closing the multi-link fd retriggers this at will."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/trampoline.c"], "versions": [{"version": "aef4dfa790b22d8052cfb78044eadbe03c876c39", "lessThan": "65c3939656fd7848e9274faa07c26748b5bf049c", "status": "affected", "versionType": "git"}, {"version": "aef4dfa790b22d8052cfb78044eadbe03c876c39", "lessThan": "0253073fb7d79a2dd2eae9581ea16db2aef395a6", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/trampoline.c"], "versions": [{"version": "7.2", "status": "affected"}, {"version": "0", "lessThan": "7.2", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.6", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.2", "versionEndExcluding": "7.2.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.2", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/65c3939656fd7848e9274faa07c26748b5bf049c"}, {"url": "https://git.kernel.org/stable/c/0253073fb7d79a2dd2eae9581ea16db2aef395a6"}], "title": "bpf: Fix UAF in bpf_trampoline_multi_attach_free on update failure", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/bpf/trampoline.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "65c3939656fd7848e9274faa07c26748b5bf049c", "status": "affected", "version": "aef4dfa790b22d8052cfb78044eadbe03c876c39", "versionType": "git"}, {"lessThan": "0253073fb7d79a2dd2eae9581ea16db2aef395a6", "status": "affected", "version": "aef4dfa790b22d8052cfb78044eadbe03c876c39", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/bpf/trampoline.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.2"}, {"lessThan": "7.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix UAF in bpf_trampoline_multi_attach_free on update failure\n\nWhen bpf_trampoline_update() fails before modify_fentry_multi()/\nunregister_fentry_multi() is called, cur_image is unchanged\n(cur_image == old_image) and ftrace still calls into it. Freeing\nold_image in that case causes a UAF.\n\nOnly free old_image when it differs from cur_image."}], "id": "CVE-2026-90210", "lastModified": "2026-10-19T09:19:11.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-17T17:17:16.217", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0253073fb7d79a2dd2eae9581ea16db2aef395a6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/65c3939656fd7848e9274faa07c26748b5bf049c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[aef4dfa790b22d8052cfb78044eadbe03c876c39,65c3939656fd7848e9274faa07c26748b5bf049c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[aef4dfa790b22d8052cfb78044eadbe03c876c39,0253073fb7d79a2dd2eae9581ea16db2aef395a6)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.6,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc1,*)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-18T19:00:06.699279+00:00", "updated": "2026-09-20T03:45:12.285320+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-416"]}