CVE-2026-52910: Linux Kernel Use-After-Free Vulnerability

CVE-2026-52910 Overview

CVE-2026-52910 is a use-after-free vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) reuseport subsystem. The flaw resides in how classic BPF (cBPF) programs attached to UDP reuseport groups are freed without waiting for an RCU (Read-Copy-Update) grace period. When a thread replaces a reuseport cBPF program via setsockopt() while another thread concurrently sends a UDP packet to the same group, readers in reuseport_select_sock() can dereference memory freed by sk_reuseport_prog_free(). The KASAN report shows a vmalloc out-of-bounds read in net/core/sock_reuseport.c:596, indicating memory corruption with the potential for denial of service or further exploitation in kernel context.

Critical Impact
Concurrent reuseport program replacement and packet delivery can trigger kernel memory corruption, potentially leading to denial of service or local privilege escalation.

Affected Products

Linux kernel versions containing the reuseport cBPF attach/detach code path prior to the referenced stable fixes
Distributions shipping the affected upstream kernel before applying commits 08264d5, 18fc650, 298db6, 87dfb97, 90e47dc, c3e3fdd, f8b8f1d, or fec4148
Systems using UDP socket groups with SO_REUSEPORT and cBPF program attachment

Discovery Timeline

2026-06-19 - CVE-2026-52910 published to NVD
2026-06-19 - Last updated in NVD database

Technical Details for CVE-2026-52910

Vulnerability Analysis

The vulnerability stems from inconsistent memory reclamation between extended BPF (eBPF) and classic BPF (cBPF) programs in the reuseport code path. When a reuseport program is detached through reuseport_attach_prog() or reuseport_detach_prog() from the setsockopt() path, sk_reuseport_prog_free() releases the program without deferring through RCU.

For eBPF programs, bpf_prog_put() schedules destruction across multiple stages, allowing RCU readers to complete. For cBPF programs, however, bpf_release_orig_filter() and bpf_prog_free() execute immediately. Concurrent receivers walking the reuseport array under RCU read locks can therefore access already-freed filter memory.

The reproducer triggers the bug by attaching a cBPF program to a UDP reuseport group and replacing it while a separate thread transmits to the group. KASAN observes a 4-byte read at ffffc9000051e004 inside reuseport_select_sock+0xedc/0x1220, confirming a use-after-free in vmalloc-backed memory.

Root Cause

The root cause is missing RCU synchronization before freeing cBPF programs attached to reuseport sockets. Receive-side code accesses the program pointer under rcu_read_lock(), but the detach path frees the program synchronously. This violates the RCU contract and produces a classic use-after-free [CWE-416].

Attack Vector

An unprivileged local user able to create UDP sockets with SO_REUSEPORT and attach cBPF programs can race program replacement against incoming traffic. Because the freed memory resides in vmalloc space, exploitation primitives include kernel information disclosure, denial of service through invalid reads, and potential code-flow corruption depending on heap shaping. The upstream patch defers freeing the reuseport cBPF program by one RCU grace period, matching the behavior already provided for eBPF programs. See the referenced Kernel Git Commit 08264d5 for the canonical fix.

Detection Methods for CVE-2026-52910

Indicators of Compromise

KASAN reports referencing reuseport_select_sock with vmalloc-out-of-bounds reads in net/core/sock_reuseport.c
Unexpected kernel oops or panics on UDP receive paths under __udp4_lib_lookup or udp4_lib_lookup2
Processes repeatedly invoking setsockopt(SO_ATTACH_REUSEPORT_CBPF) followed by program replacement on shared UDP groups

Detection Strategies

Enable KASAN on test and pre-production kernels to surface the underlying memory error before deployment
Audit auditd or eBPF-based telemetry for unprivileged processes attaching cBPF filters to reuseport groups
Correlate kernel ring-buffer messages with process activity to identify race-condition triggers

Monitoring Recommendations

Monitor kernel logs (dmesg, journalctl -k) for BUG: KASAN or general protection fault entries citing reuseport functions
Track setsockopt syscalls with options SO_ATTACH_REUSEPORT_CBPF and SO_ATTACH_REUSEPORT_EBPF from non-system accounts
Alert on repeated kernel crashes on hosts serving high-volume UDP workloads such as DNS or QUIC frontends

How to Mitigate CVE-2026-52910

Immediate Actions Required

Apply the upstream stable kernel patches listed in the references and reboot affected hosts
Inventory workloads that rely on SO_REUSEPORT with cBPF filters, including UDP load balancers and DNS services
Restrict the ability of unprivileged users to attach BPF programs by tightening kernel.unprivileged_bpf_disabled

Patch Information

The fix defers freeing the reuseport cBPF program until after one RCU grace period, aligning cBPF behavior with eBPF. Stable backports are available in the following commits: Kernel Git Commit 08264d5, Kernel Git Commit 18fc650, Kernel Git Commit 298db61, Kernel Git Commit 87dfb97, Kernel Git Commit 90e47dc, Kernel Git Commit c3e3fdd, Kernel Git Commit f8b8f1d, and Kernel Git Commit fec4148.

Workarounds

Disable unprivileged BPF by setting kernel.unprivileged_bpf_disabled=1 until patches are applied
Avoid runtime replacement of cBPF programs on active reuseport groups; recreate sockets instead
Constrain workloads using reuseport cBPF to trusted, single-tenant hosts pending remediation

bash

# Configuration example
sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/90-bpf-hardening.conf