CVE-2026-90393 bpf: Fix potential UAF in bpf_netns_link_update_prog
A race condition in the Linux kernel's BPF netns link update allows local attackers to trigger a use-after-free, potentially leading to privilege escalation or code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90393?
CVE-2026-90393 is an use after free vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix potential UAF in bpf_netns_link_update_prog
In bpf_netns_link_update_prog, the checks for old_prog and prog type are currently performed locklessly before acquiring netns_bpf_mutex. This creates a race condition that can lead to a UAF issue.
If two threads concurrently execute BPF_LINK_UPDATE on the same netns link, the following execution path can trigger a UAF:
CPU0 CPU1 bpf_netns_link_update_prog if (old_prog && old_prog != link->prog) return -EPERM; bpf_netns_link_update_prog if (old_prog && old_prog != link->prog) ... old_prog = xchg(&link->prog, new_prog); bpf_prog_put(old_prog); if (new_prog->type != link->prog->type) <-- trigger UAF
Fix this by moving the old_prog and prog->type checks inside the netns_bpf_mutex critical section. Meanwhile, use guard() to simplify lock management and avoid all the goto jumping.
Which versions are affected by CVE-2026-90393?
How do I fix CVE-2026-90393?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-90393 being exploited?
There is no known exploitation of CVE-2026-90393 in the wild and no public exploit code.
Sources
Also known as AZL-101897, BELL-CVE-2026-90393, DEBIAN-CVE-2026-90393, GHSA-9prj-6xm5-hxjf, UBUNTU-CVE-2026-90393.