Go to homepageCyberStrike

Menu

Star on GitHub · 3.4k
Sign inDownload

CVE-2026-90392

7.8 · HIGH

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF when reading bpf link info In bpf_link_show_fdinfo and bpf_link_get_info_by_fd, link->prog is accessed w…

Published Sep 17, 2026EPSS 0.17%

Overview

CVE-2026-90392 is a high-severity vulnerability. It was published on September 17, 2026 and has a CVSS 3.1 base score of 7.8 (HIGH).

This vulnerability has a CVSS 3.1 base score of 7.8, rated HIGH. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix potential UAF when reading bpf link info

In bpf_link_show_fdinfo and bpf_link_get_info_by_fd, link->prog is

accessed without holding any locks. If the prog is concurrently replaced

via bpf_link_update, the old prog can be freed, leading to a potential

UAF issue.

Fix this by accessing link->prog under RCU protection to safely fetch

the pointer and guarantee its lifetime while reading its fields.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

Refgit.kernel.org/stable/c/4c8432a332d4a24dc2742f56062a53d8fad36f53Refgit.kernel.org/stable/c/79347e42cfbc9e78872922e8f08a70609c9af82fRefgit.kernel.org/stable/c/85cf991c881e7198be32be05a9daa2625390c8b3Refgit.kernel.org/stable/c/863f3ddd0b8ac65abfb50d3be0869268ac0e277bRefgit.kernel.org/stable/c/a5c936ac904767fc1d943d40b0308bcb2ae2509bRefgit.kernel.org/stable/c/d7d7208e2603b45724b684f4df73904fb347741e

How CyberStrike helps

Frequently asked questions

What is CVE-2026-90392?

CVE-2026-90392 is a high-severity vulnerability. It was published on September 17, 2026 and has a CVSS 3.1 base score of 7.8 (HIGH).

How severe is CVE-2026-90392?

This vulnerability has a CVSS 3.1 base score of 7.8, rated HIGH. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2026-90392?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2026-90392?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2026-90392 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related HIGH CVEs from 2026

View all
Browse by year2026202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999
LiveWatch live →