CVE-2026-53089

Awaiting Analysis Awaiting Analysis - Queue

Use-After-Free in Linux Kernel BPF Subsystem

Publication date: 2026-06-24

Last updated on: 2026-07-23

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free in offloaded map/prog info fill When querying info for an offloaded BPF map or program, bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns() obtain the network namespace with get_net(dev_net(offmap->netdev)). However, the associated netdev's netns may be racing with teardown during netns destruction. If the netns refcount has already reached 0, get_net() performs a refcount_t increment on 0, triggering: refcount_t: addition on 0; use-after-free. Although rtnl_lock and bpf_devs_lock ensure the netdev pointer remains valid, they cannot prevent the netns refcount from reaching zero. Fix this by using maybe_get_net() instead of get_net(). maybe_get_net() uses refcount_inc_not_zero() and returns NULL if the refcount is already zero, which causes ns_get_path_cb() to fail and the caller to return -ENOENT -- the correct behavior when the netns is being destroyed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-23

Generated

2026-08-04

AI Q&A

2026-06-24

EPSS Evaluated

2026-08-02

NVD

CVE-2026-53089

EUVD

EUVD-2026-38957

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 4.16 (inc) to 7.0.10 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability is a use-after-free issue in the Linux kernel related to BPF (Berkeley Packet Filter) offloaded map and program information retrieval.

When querying information for an offloaded BPF map or program, certain functions obtain the network namespace using get_net(). However, if the network namespace's reference count has already reached zero due to destruction, get_net() increments a zero reference count, causing a use-after-free error.

The problem arises because although locks ensure the network device pointer remains valid, they cannot prevent the network namespace reference count from reaching zero during teardown.

The fix replaces get_net() with maybe_get_net(), which safely checks the reference count and returns NULL if the namespace is being destroyed, preventing the use-after-free.

Impact Analysis

This vulnerability can lead to a use-after-free condition in the Linux kernel when handling BPF offloaded map or program information.

Use-after-free bugs can cause system instability, crashes, or potentially allow attackers to execute arbitrary code or escalate privileges if exploited.

Therefore, systems running vulnerable Linux kernels could be at risk of denial of service or other security issues related to kernel memory corruption.

Mitigation Strategies

The vulnerability is fixed by updating the Linux kernel to a version that uses maybe_get_net() instead of get_net() when querying offloaded BPF map or program info. This prevents use-after-free errors related to network namespace refcounting.

Therefore, the immediate step to mitigate this vulnerability is to apply the patch or upgrade your Linux kernel to the fixed version published on or after 2026-06-24.

Hi! I’m here to help you understand CVE-2026-53089. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70