CVE-2026-53089: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53089 Overview

CVE-2026-53089 is a use-after-free vulnerability in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. The flaw resides in bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns(), which query namespace information for offloaded BPF maps and programs. These functions call get_net(dev_net(offmap->netdev)) to acquire the network namespace, but the netdev's netns can race with namespace teardown. When the netns reference count has already reached zero, get_net() increments a refcount on a freed object, triggering a use-after-free condition flagged by the kernel as refcount_t: addition on 0; use-after-free.

Critical Impact
A race between BPF info queries and network namespace destruction can corrupt kernel reference counts, resulting in memory corruption and potential local denial of service or privilege escalation on systems using offloaded BPF programs.

Affected Products

Linux kernel versions containing the offloaded BPF map/program info-fill code path
Distributions packaging vulnerable mainline and stable kernel releases
Systems leveraging hardware-offloaded BPF (e.g., SmartNIC environments)

Discovery Timeline

2026-06-24 - CVE-2026-53089 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53089

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] in the Linux kernel BPF subsystem affecting offloaded BPF objects. When a user queries information about an offloaded BPF map or program, the kernel attempts to resolve the associated network namespace through the offloaded netdev. The query path acquires the namespace using get_net(dev_net(offmap->netdev)), which unconditionally increments the namespace reference counter.

The defect arises because the netdev's bound namespace may be undergoing destruction concurrently. Although rtnl_lock and bpf_devs_lock guarantee the netdev pointer remains valid for the duration of the call, neither lock prevents the namespace refcount from dropping to zero. If the namespace has already been released, get_net() performs a refcount_t addition on a value of zero, which the kernel's refcount infrastructure detects and reports as a use-after-free.

Root Cause

The root cause is unsafe reference acquisition on an object whose lifetime is not protected by the locks held in the caller. The code assumed that holding rtnl_lock and bpf_devs_lock was sufficient to keep the namespace alive, but those locks only protect netdev membership, not namespace lifetime. The get_net() helper does not validate the source refcount before incrementing it.

Attack Vector

Exploitation requires local access and the ability to issue BPF syscalls that query offloaded object metadata while triggering namespace teardown. An attacker with sufficient privileges to interact with BPF interfaces can race namespace destruction against an info-fill query to provoke the refcount violation. The successful patch replaces get_net() with maybe_get_net(), which uses refcount_inc_not_zero() and safely returns NULL when the namespace refcount is already zero, causing the caller to return -ENOENT.

No verified public exploitation code is available for this issue. Technical details are documented in the upstream commits a0c584fc1805 and a51e7fbe94a8.

Detection Methods for CVE-2026-53089

Indicators of Compromise

Kernel log entries containing refcount_t: addition on 0; use-after-free originating from BPF offload code paths
Unexpected kernel oopses or panics referencing bpf_map_offload_info_fill_ns or bpf_prog_offload_info_fill_ns
Repeated BPF_OBJ_GET_INFO_BY_FD syscalls correlated with network namespace teardown events

Detection Strategies

Enable kernel CONFIG_REFCOUNT_FULL warnings and monitor dmesg for refcount saturation messages tied to BPF symbols
Audit kernel crash dumps for stack traces invoking bpf_*_offload_info_fill_ns() during netns cleanup
Correlate BPF syscall telemetry with unshare() or container teardown activity from untrusted workloads

Monitoring Recommendations

Forward kernel ring buffer logs to a centralized analytics platform and alert on refcount and use-after-free warnings
Track installed kernel versions across the fleet to identify hosts still running pre-patch builds
Monitor for abnormal BPF program enumeration activity from non-root containers and unprivileged users

How to Mitigate CVE-2026-53089

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in commits a0c584fc1805 and a51e7fbe94a8 as soon as distribution updates are available
Restrict access to the BPF syscall using kernel.unprivileged_bpf_disabled=1 to limit who can trigger the vulnerable code path
Inventory hosts using hardware-offloaded BPF (SmartNIC deployments) and prioritize them for remediation

Patch Information

The fix replaces get_net() with maybe_get_net() in both bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns(). maybe_get_net() uses refcount_inc_not_zero() and returns NULL if the namespace refcount is already zero, allowing ns_get_path_cb() to fail cleanly and the caller to return -ENOENT. Patches are available in the upstream stable tree via the Kernel Git Commit a0c584fc1805 and Kernel Git Commit a51e7fbe94a8.

Workarounds

Disable unprivileged BPF access via the kernel.unprivileged_bpf_disabled sysctl until the patched kernel is deployed
Avoid using hardware-offloaded BPF features on multi-tenant or container hosts where untrusted code can trigger namespace teardown
Constrain container and namespace creation privileges using seccomp and user-namespace restrictions

bash

# Configuration example
# Restrict BPF syscall access until patched kernel is deployed
sudo sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/90-bpf-hardening.conf

# Verify installed kernel version against patched build
uname -r