{"cve":"CVE-2026-90393","nvd":{"published":"2026-09-17T17:17:38.903","modified":"2026-10-19T09:19:33.373","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix potential UAF in bpf_netns_link_update_prog\n\nIn bpf_netns_link_update_prog, the checks for old_prog and prog type\nare currently performed locklessly before acquiring netns_bpf_mutex.\nThis creates a race condition that can lead to a UAF issue.\n\nIf two threads concurrently execute BPF_LINK_UPDATE on the same netns\nlink, the following execution path can trigger a UAF:\n\nCPU0                                          CPU1\nbpf_netns_link_update_prog\n  if (old_prog && old_prog != link->prog)\n    return -EPERM;\n                                              bpf_netns_link_update_prog\n                                                if (old_prog && old_prog != link->prog)\n                                                ...\n                                                old_prog = xchg(&link->prog, new_prog);\n                                                bpf_prog_put(old_prog);\n  if (new_prog->type != link->prog->type) <-- trigger UAF\n\nFix this by moving the old_prog and prog->type checks inside the\nnetns_bpf_mutex critical section. Meanwhile, use guard() to simplify\nlock management and avoid all the goto jumping.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/277168cb9d153ce8e9c3f9275670e32ae61b41d6","https://git.kernel.org/stable/c/5c5997836381010fc5907b36bc17d3b19407e933","https://git.kernel.org/stable/c/79a66fd997d4eecf17302d613194879eb32e0986","https://git.kernel.org/stable/c/923f559e95b89b33c7e1793b3d8f7f4ec9b2e4b7","https://git.kernel.org/stable/c/bda86e9f31b9a296b6e64a51c91dc776fc9f613e"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:55:23.253742848+00:00"},"epss":{"cve":"CVE-2026-90393","score":0.00233,"percentile":0.14037,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}