CVE-2026-89580: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89580 Overview

CVE-2026-89580 is a Linux kernel vulnerability in the Berkeley Packet Filter (BPF) subsystem. The flaw resides in the __bpf_get_stack() helper function, which consumes a per-CPU perf_callchain_entry buffer without disabling preemption. A preemptible BPF program can be scheduled out between obtaining the callchain entry and copying it, allowing another task on the same CPU to reuse the buffer and inflate trace->nr. The resulting copy_len can exceed the caller's buffer, producing an out-of-bounds write in the memcpy() and build ID resolution paths. Local attackers with the ability to load BPF programs can trigger memory corruption on affected kernels.

Critical Impact
A local, low-privileged attacker able to attach a preemptible BPF program can trigger an out-of-bounds kernel write leading to memory corruption, denial of service, or potential privilege escalation.

Affected Products

Linux kernel branches containing the preemptible BPF callchain code path in kernel/bpf/stackmap.c
Distributions shipping affected upstream kernel versions prior to the fix commits
PREEMPT and PREEMPT_RCU enabled kernel builds executing raw tracepoint BPF programs

Discovery Timeline

2026-09-11 - CVE-2026-89580 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89580

Vulnerability Analysis

The defect lives in the BPF stack collection helper __bpf_get_stack() inside the Linux kernel's tracing infrastructure. get_perf_callchain() returns a pointer to a per-CPU perf_callchain_entry buffer and immediately releases its recursion slot with put_callchain_entry() before returning. Nothing keeps the entry reserved while the caller reads trace->nr and copies instruction pointers into the user-supplied buffer.

On PREEMPT kernels, a non-sleepable raw tracepoint BPF program runs under migrate_disable() but not preempt_disable(). The program can be preempted between obtaining the callchain entry and consuming it. A second task scheduled on the same CPU then reuses the same per-CPU buffer and overwrites trace->nr with a larger value. The original program resumes, computes copy_len from the inflated count, and writes past the end of the caller's buffer.

Root Cause

The root cause is missing preemption protection around a per-CPU buffer access [CWE-362 race condition]. The rcu_read_lock() in the may_fault path only keeps the perf callchain buffer array alive against call_rcu() reclamation. Under CONFIG_PREEMPT_RCU, it does not disable preemption and cannot prevent another task from clobbering the shared per-CPU entry.

Attack Vector

Exploitation requires local code execution and the ability to load a BPF program that invokes bpf_get_stack() or bpf_get_stackid(). An attacker attaches a preemptible raw tracepoint program on a PREEMPT kernel, then races execution across CPUs to trigger reuse of the per-CPU callchain buffer while __bpf_get_stack() is mid-copy. The inflated trace->nr drives an out-of-bounds memcpy() write into adjacent kernel memory, corrupting kernel state.

No verified public exploit code is available. See the upstream fix commits for technical details: Kernel Git Commit 8c5ba02, Kernel Git Commit 9a23747, Kernel Git Commit b1a47b2, and Kernel Git Commit dbfecc8.

Detection Methods for CVE-2026-89580

Indicators of Compromise

Unexpected kernel oops or panic traces referencing __bpf_get_stack, stack_map_get_build_id_offset, or memcpy in kernel/bpf/stackmap.c
KASAN: slab-out-of-bounds or KASAN: use-after-free reports involving perf callchain buffers on PREEMPT kernels
Unprivileged or workload processes loading raw tracepoint BPF programs that call bpf_get_stack or bpf_get_stackid

Detection Strategies

Audit bpf() syscall usage with auditd rules on -a always,exit -F arch=b64 -S bpf to identify processes attaching tracepoint programs
Enable KASAN and KFENCE on test kernels to catch out-of-bounds writes originating in the BPF stack helpers
Correlate abnormal kernel log messages with recent BPF program loads via bpftool prog show telemetry

Monitoring Recommendations

Ship kernel ring buffer output (dmesg, journalctl -k) to a centralized logging platform and alert on bpf, stackmap, or KASAN strings
Track uses of the CAP_BPF, CAP_PERFMON, and CAP_SYS_ADMIN capabilities across workloads to identify processes with BPF loading rights
Monitor for new eBPF program attachments to raw tracepoints using tools such as bpftool prog list executed on a schedule

How to Mitigate CVE-2026-89580

Immediate Actions Required

Apply the upstream stable kernel updates that include commits 8c5ba02, 9a23747, b1a47b2, and dbfecc8 as soon as vendor packages are available
Restrict BPF program loading to trusted users by tightening kernel.unprivileged_bpf_disabled and controlling CAP_BPF and CAP_PERFMON grants
Inventory hosts running PREEMPT kernels with tracing workloads and prioritize them for patching

Patch Information

The fix disables preemption around obtaining the callchain entry and copying it into the caller's buffer, keeping trace->nr bounded by max_depth. Build ID resolution is deferred until after preemption is re-enabled because it may fault, and it operates only on the private copy already written to buf. Fix commits are available at Kernel Git Commit 8c5ba02, Kernel Git Commit 9a23747, Kernel Git Commit b1a47b2, and Kernel Git Commit dbfecc8.

Workarounds

Disable unprivileged BPF via sysctl -w kernel.unprivileged_bpf_disabled=1 to reduce the attack surface on unpatched hosts
Remove CAP_BPF and CAP_PERFMON from containerized workloads that do not require kernel tracing capabilities
Where feasible, avoid deploying non-sleepable raw tracepoint programs that call bpf_get_stack on PREEMPT kernels until patches are applied

bash

# Disable unprivileged BPF program loading at runtime
sysctl -w kernel.unprivileged_bpf_disabled=1

# Persist the setting across reboots
echo 'kernel.unprivileged_bpf_disabled=1' > /etc/sysctl.d/90-bpf-hardening.conf

# Verify current setting
sysctl kernel.unprivileged_bpf_disabled