CVE-2026-23319

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim

The root cause of this bug is that when bpf_link_put reduces the refcount of shim_link->link.link to zero, the resource is considered released but may still be referenced via tr->progs_hlist in cgroup_shim_find. The actual cleanup of tr->progs_hlist in bpf_shim_tramp_link_release is deferred. During this window, another process can cause a use-after-free via bpf_trampoline_link_cgroup_shim.

Based on Martin KaFai Laus suggestions, I have created a simple patch.

To fix this: Add an atomic non-zero check in bpf_trampoline_link_cgroup_shim. Only increment the refcount if it is not already zero.

Testing: I verified the fix by adding a delay in bpf_shim_tramp_link_release to make the bug easier to trigger:

static void bpf_shim_tramp_link_release(struct bpf_link link) { / … */ if (!shim_link->trampoline) return;

• msleep(100); WARN_ON_ONCE(bpf_trampoline_unlink_prog(&shim_link->link, shim_link->trampoline, NULL)); bpf_trampoline_put(shim_link->trampoline); }

Before the patch, running a PoC easily reproduced the crash(almost 100%) with a call trace similar to KaiyanMs report. After the patch, the bug no longer occurs even after millions of iterations.

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Potential Mitigations

References

• https://git.kernel.org/stable/c/3eeddb80191f7626ec1ef742bfff51ec3b0fa5c2
• https://git.kernel.org/stable/c/4e8a0005d633a4adc98e3b65d5080f93b90d356b
• https://git.kernel.org/stable/c/529e685e522b9d7fb379dbe6929dcdf520e34c8c
• https://git.kernel.org/stable/c/56145d237385ca0e7ca9ff7b226aaf2eb8ef368b
• https://git.kernel.org/stable/c/9b02c5c4147f8af8ed783c8deb5df927a55c3951
• https://git.kernel.org/stable/c/cfcfa0ca0212162aa472551266038e8fd6768cff