{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/trampoline.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "65c3939656fd7848e9274faa07c26748b5bf049c",
              "status": "affected",
              "version": "aef4dfa790b22d8052cfb78044eadbe03c876c39",
              "versionType": "git"
            },
            {
              "lessThan": "0253073fb7d79a2dd2eae9581ea16db2aef395a6",
              "status": "affected",
              "version": "aef4dfa790b22d8052cfb78044eadbe03c876c39",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/trampoline.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.2"
            },
            {
              "lessThan": "7.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "7.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "7.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix UAF in bpf_trampoline_multi_attach_free on update failure\n\nWhen bpf_trampoline_update() fails before modify_fentry_multi()/\nunregister_fentry_multi() is called, cur_image is unchanged\n(cur_image == old_image) and ftrace still calls into it.  Freeing\nold_image in that case causes a UAF.\n\nOnly free old_image when it differs from cur_image."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is reached only via the local bpf() syscall: BPF_PROG_LOAD of BPF_PROG_TYPE_TRACING with BPF_TRACE_FENTRY_MULTI/FEXIT_MULTI/FSESSION_MULTI, BPF_LINK_CREATE into bpf_tracing_multi_attach(), then close() of that link fd which runs bpf_tracing_multi_link_release() -\u003e bpf_trampoline_multi_detach() -\u003e bpf_trampoline_multi_attach_free().\nAC:L - The attacker attaches a second fentry program on the same ftrace-managed function so detach rebuilds the trampoline, then closes the multi-link fd. bpf_trampoline_multi_detach() WARN_ON_ONCE-ignores bpf_trampoline_update() failure before modify_fentry_multi() and still calls bpf_trampoline_multi_attach_free(); ENOMEM from bpf_tramp_image_alloc() or arch_prepare_bpf_trampoline() is inducible by exhausting bpf_prog_pack from that process.\nPR:L - bpf_prog_load() requires bpf_token_capable(CAP_BPF) and bpf_token_capable(CAP_PERFMON) for BPF_PROG_TYPE_TRACING. bpf_token_capable() calls ns_capable() on a delegated BPF token\u0027s user namespace, so a container user with a token (or a non-root tracing daemon holding only those two caps) can load and attach fentry.multi without host root.\nUI:N - The attacker loads the tracing programs, creates the tracing-multi link with BPF_LINK_CREATE, and closes their own link fd to hit bpf_trampoline_multi_attach_free(); no other user must mount, open a file, or otherwise act.\nS:U - The UAF of bpf_tramp_image and its JIT text, and any resulting kernel control-flow hijack, remain inside the host kernel; this is a standard kernel privilege-escalation defect, not a VM escape or IOMMU/guest boundary crossing.\nC:H - On the failing detach path bpf_trampoline_multi_attach_free() calls bpf_tramp_image_put() while ftrace still direct-calls that image (old_image == cur_image). After the RCU tasks-trace GP, bpf_prog_pack_free() returns those pages; reclaiming them exposes kernel/JIT contents and yields an arbitrary-read primitive.\nI:H - ftrace keeps a direct call into the trampoline that bpf_tramp_image_put() is freeing. Reclaiming the bpf_prog_pack pages with attacker-controlled BPF JIT text makes the next call of the traced function jump to chosen kernel instructions, i.e. control-flow hijack and arbitrary write.\nA:H - After bpf_tramp_image_put() of a trampoline that ftrace still invokes, the next entry to the attached kernel function jumps into freed executable memory and oopses/panics. Closing the multi-link fd retriggers this at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:53:47.303Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/65c3939656fd7848e9274faa07c26748b5bf049c"
        },
        {
          "url": "https://git.kernel.org/stable/c/0253073fb7d79a2dd2eae9581ea16db2aef395a6"
        }
      ],
      "title": "bpf: Fix UAF in bpf_trampoline_multi_attach_free on update failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90210",
    "datePublished": "2026-09-17T16:07:24.772Z",
    "dateReserved": "2026-09-11T19:38:34.793Z",
    "dateUpdated": "2026-09-18T17:53:47.303Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}