GHSA-2MRF-G72X-R6VX

Vulnerability from github – Published: 2026-09-17 18:32 – Updated: 2026-09-17 18:32
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed

A potential invalid storage access issue can occur after replacing a cgroup bpf prog.

This occurs in the following scenario: 1. prog1 with storage is attached to a cgroup in multi-attach mode. 2. prog1 is replaced with prog2 using BPF_F_REPLACE in multi-attach mode, but fails midway (e.g. in bpf_trampoline_link_cgroup_shim or update_effective_progs). 3. A new prog3 is attached to the cgroup in multi-attach mode.

The reason is that __cgroup_bpf_attach overwrites pl->storage with the new storage prior to attachment completion. When attachment fails midway, the cleanup path calls bpf_cgroup_storages_free(new_storage) to free the newly allocated storage, but fails to restore pl->storage back to old_storage.

Consequently, the still-active prog1 holds invalid or dangling storage pointers, leading to an invalid memory access when prog1 executes and calls bpf_get_local_storage. Additionally, original pl->flags and cgrp->bpf.flags[atype] are left unrestored.

Fix this by saving old_pl_flags, old_storage, and old_flags prior to the update, and properly restoring all of them in the cleanup path on error.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-90313"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-17T17:17:29Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed\n\nA potential invalid storage access issue can occur after replacing a\ncgroup bpf prog.\n\nThis occurs in the following scenario:\n1. prog1 with storage is attached to a cgroup in multi-attach mode.\n2. prog1 is replaced with prog2 using BPF_F_REPLACE in multi-attach\n   mode, but fails midway (e.g. in bpf_trampoline_link_cgroup_shim or\n   update_effective_progs).\n3. A new prog3 is attached to the cgroup in multi-attach mode.\n\nThe reason is that __cgroup_bpf_attach overwrites pl-\u003estorage with the\nnew storage prior to attachment completion. When attachment fails\nmidway, the cleanup path calls bpf_cgroup_storages_free(new_storage) to\nfree the newly allocated storage, but fails to restore pl-\u003estorage back\nto old_storage.\n\nConsequently, the still-active prog1 holds invalid or dangling storage\npointers, leading to an invalid memory access when prog1 executes and\ncalls bpf_get_local_storage. Additionally, original pl-\u003eflags and\ncgrp-\u003ebpf.flags[atype] are left unrestored.\n\nFix this by saving old_pl_flags, old_storage, and old_flags prior to the\nupdate, and properly restoring all of them in the cleanup path on error.",
  "id": "GHSA-2mrf-g72x-r6vx",
  "modified": "2026-09-17T18:32:00Z",
  "published": "2026-09-17T18:32:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90313"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2c2218560b6e28a63ff7834ba26d09ff8efdee39"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6655c409707ec8ce9ce0850ffe4fe02331fd4d9c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/86ead176301109b78e1d14c0e9d0d9ff9723c769"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/aaca16e042527f7efe48b50799bc662f1a191ce1"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e26db0d636e4c24a6b16683ea95cf5077c64d74b"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.