CVE-2026-52910

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Free reuseport cBPF prog after RCU grace period.

Eulgyu Kim reported the splat below with a repro. [0]

The repro sets up a UDP reuseport group with a cBPF prog and

replaces it with a new one while another thread is sending

a UDP packet to the group.

The reuseport prog is freed by sk_reuseport_prog_free().

bpf_prog_put() is called for "e"BPF prog to destruct through

multiple stages while cBPF prog is freed immediately by

bpf_release_orig_filter() and bpf_prog_free().

If a reuseport prog is detached from the setsockopt() path

(reuseport_attach_prog() or reuseport_detach_prog()),

sk_reuseport_prog_free() is called without waiting for RCU

readers to complete, resulting in various bugs.

Let's defer freeing the reuseport cBPF prog after one RCU

grace period.

Note "e"BPF prog is safe as is unless the fast path starts

to touch fields destroyed in bpf_prog_put_deferred() and

__bpf_prog_put_noref().

[0]:

BUG: KASAN:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References