Not yet scoredPublished Sep 17, 2026

CVE-2026-90393bpf: Fix potential UAF in bpf_netns_link_update_prog

Updated under an hour ago (Oct 29, 2026, 7:00 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF in bpf_netns_link_update_prog In bpf_netns_link_update_prog, the checks for old_prog and prog type are currently performed locklessly before acquiring netns_bpf_mutex. This creates a race condition that can lead to a UAF issue. If two threads concurrently execute BPF_LINK_UPDATE on the same netns link, the following execution path can trigger a UAF: CPU0 CPU1 bpf_netns_link_update_prog if (old_prog && old_prog != link->prog) return -EPERM; bpf_netns_link_update_prog if (old_prog && old_prog != link->prog) ... old_prog = xchg(&link->prog, new_prog); bpf_prog_put(old_prog); if (new_prog->type != link->prog->type) <-- trigger UAF Fix this by moving the old_prog and prog->type checks inside the netns_bpf_mutex critical section. Meanwhile, use guard() to simplify lock management and avoid all the goto jumping.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 7f045a49fee04b5662cbdeaf0838f9322ae8c63a before d462b5481d77ce7df8a5ff89a699386f00c9214d; from 7f045a49fee04b5662cbdeaf0838f9322ae8c63a before bdddf3e1493ee973619c154a57071ce67f78598b; from 7f045a49fee04b5662cbdeaf0838f9322ae8c63a before 79a66fd997d4eecf17302d613194879eb32e0986; from 7f045a49fee04b5662cbdeaf0838f9322ae8c63a before f4ce6803df4095777191d800bebc50219b615ca0; from 7f045a49fee04b5662cbdeaf0838f9322ae8c63a before 277168cb9d153ce8e9c3f9275670e32ae61b41d6; from 7f045a49fee04b5662cbdeaf0838f9322ae8c63a before bda86e9f31b9a296b6e64a51c91dc776fc9f613e; from 7f045a49fee04b5662cbdeaf0838f9322ae8c63a before 923f559e95b89b33c7e1793b3d8f7f4ec9b2e4b7; 7f045a49fee04b5662cbdeaf0838f9322ae8c63a builds before 5c5997836381010fc5907b36bc17d3b19407e933	CNA record

References

References

https://git.kernel.org/stable/c/d462b5481d77ce7df8a5ff89a699386f00c9214d
https://git.kernel.org/stable/c/bdddf3e1493ee973619c154a57071ce67f78598b
https://git.kernel.org/stable/c/79a66fd997d4eecf17302d613194879eb32e0986
https://git.kernel.org/stable/c/f4ce6803df4095777191d800bebc50219b615ca0
https://git.kernel.org/stable/c/277168cb9d153ce8e9c3f9275670e32ae61b41d6
https://git.kernel.org/stable/c/bda86e9f31b9a296b6e64a51c91dc776fc9f613e
https://git.kernel.org/stable/c/923f559e95b89b33c7e1793b3d8f7f4ec9b2e4b7
https://git.kernel.org/stable/c/5c5997836381010fc5907b36bc17d3b19407e933

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.