bpf: Free reuseport cBPF prog after RCU grace period.
In the Linux kernel, the following vulnerability has been resolved: bpf: Free reuseport cBPF prog after RCU grace period. Eulgyu Kim reported the splat below with a repro. [0] The repro sets up a UDP reuseport group with a cBPF prog and replaces it with a new one while another thread is sending a UDP packet to the group. The reuseport prog is freed by sk_reuseport_prog_free(). bpf_prog_put() is called for "e"BPF prog to destruct through multiple stages while cBPF prog is freed immediately by bpf_release_orig_filter() and bpf_prog_free(). If a reuseport prog is detached from the setsockopt() path (reuseport_attach_prog() or reuseport_detach_prog()), sk_reuseport_prog_free() is called without waiting for RCU readers to complete, resulting in various bugs. Let's defer freeing the reuseport cBPF prog after one RCU grace period. Note "e"BPF prog is safe as is unless the fast path starts to touch fields destroyed in bpf_prog_put_deferred() and __bpf_prog_put_noref(). [0]: BUG: KASAN: vmalloc-out-of-bounds in reuseport_select_sock+0xedc/0x1220 net/core/sock_reuseport.c:596 Read of size 4 at addr ffffc9000051e004 by task slowme/10208 CPU: 6 UID: 1000 PID: 10208 Comm: slowme Not tainted 7.0.0-geb7ac95ff75e #32 PREEMPT(full) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/
CVE-2026-52910
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-52910
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "538950a1b7527a0a52ccd9337e3fcd304f027f13",
"lessThan": "08264d5bba0bdd3a79bc2984fee09286aba0c4eb",
"versionType": "git"
},
{
"status": "affected",
"version": "538950a1b7527a0a52ccd9337e3fcd304f027f13",
"lessThan": "fec41484e7c2aa7ded44c541bba98872be937754",
"versionType": "git"
},
{
"status": "affected",
"version": "538950a1b7527a0a52ccd9337e3fcd304f027f13",
"lessThan": "c3e3fddda6b5d9ba505d218b4055e7d8a282ac57",
"versionType": "git"
},
{
"status": "affected",
"version": "538950a1b7527a0a52ccd9337e3fcd304f027f13",
"lessThan": "f8b8f1d4bb76098e87b8269a0631019648330e6d",
"versionType": "git"
},
{
"status": "affected",
"version": "538950a1b7527a0a52ccd9337e3fcd304f027f13",
"lessThan": "298db6167f81e9c470a57cf652e4e47757b4293e",
"versionType": "git"
},
{
"status": "affected",
"version": "538950a1b7527a0a52ccd9337e3fcd304f027f13",
"lessThan": "87dfb977bdb6eaa47e9993a34e18f44970f88b1f",
"versionType": "git"
},
{
"status": "affected",
"version": "538950a1b7527a0a52ccd9337e3fcd304f027f13",
"lessThan": "90e47dc5c572d1c73971ac51c7428803f42b78eb",
"versionType": "git"
},
{
"status": "affected",
"version": "538950a1b7527a0a52ccd9337e3fcd304f027f13",
"lessThan": "18fc650ccd7fe3376eca89203668cfb8268f60df",
"versionType": "git"
}
],
"programFiles": [
"net/core/filter.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.5"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.5",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/core/filter.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-52910
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #40687 · Revision 1
- Added to Heist Feed
- Publisher date