Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2026-23319bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim The root cause of this bug is that when 'bpf_link_put' reduces the refcount of 'shim_link->link.link' to zero, the resource is considered released but may still be referenced via 'tr->progs_hlist' in 'cgroup_shim_find'. The actual cleanup of 'tr->progs_hlist' in 'bpf_shim_tramp_link_release' is deferred. During this window, another process can cause a use-after-free via 'bpf_trampoline_link_cgroup_shim'. Based on Martin KaFai Lau's suggestions, I have created a simple patch. To fix this: Add an atomic non-zero check in 'bpf_trampoline_link_cgroup_shim'. Only increment the refcount if it is not already zero. Testing: I verified the fix by adding a delay in 'bpf_shim_tramp_link_release' to make the bug easier to trigger: static void bpf_shim_tramp_link_release(struct bpf_link *link) { /* ... */ if (!shim_link->trampoline) return; + msleep(100); WARN_ON_ONCE(bpf_trampoline_unlink_prog(&shim_link->link, shim_link->trampoline, NULL)); bpf_trampoline_put(shim_link->trampoline); } Before the patch, running a PoC easily reproduced the crash(almost 100%) with a call trace similar to KaiyanM's report. After the patch, the bug no longer occurs even after millions of iterations.

Timeline

  1. ID reserved

    By Linux

  2. · 2 months later

    Published

  3. · 8 months later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-23319, by who scored it
Scored byCVSSScoreVector
NVDNVD · Modified3.1High7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
0.14% · top 97% of all CVEs (15 Nov 2026)
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.

Affected products

  • Linux · Linux

    • affected 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e – < 529e685e522b9d7fb379dbe6929dcdf520e34c8c
    • affected 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e – < 9b02c5c4147f8af8ed783c8deb5df927a55c3951
    • affected 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e – < cfcfa0ca0212162aa472551266038e8fd6768cff
    • affected 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e – < 3eeddb80191f7626ec1ef742bfff51ec3b0fa5c2
    • affected 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e – < 4e8a0005d633a4adc98e3b65d5080f93b90d356b
    • affected 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e – < 56145d237385ca0e7ca9ff7b226aaf2eb8ef368b

  • Linux · Linux

    • affected 6.0
    • unaffected < 6.0
    • unaffected 6.1.167 – ≤ 6.1.*
    • unaffected 6.6.130 – ≤ 6.6.*
    • unaffected 6.12.77 – ≤ 6.12.*
    • unaffected 6.18.17 – ≤ 6.18.*
    • unaffected 6.19.7 – ≤ 6.19.*
    • unaffected 7.0 – ≤ *

References

References10

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-23319 badge
[![CVE-2026-23319](https://cveledger.app/badge/CVE-2026-23319.svg)](https://cveledger.app/cve/CVE-2026-23319)

Record last updated .