CVE-2026-90392 (CVSS 7.8)

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF when reading bpf link info In bpf_link_show_fdinfo and bpf_link_get_info_by_fd, link->prog is accessed without holding any locks. If the prog is concurrently replaced via bpf_link_update, the old prog can be freed, leading to a potential UAF issue. Fix this by accessing link->prog under RCU protection to safely fetch the pointer and guarantee its lifetime while reading its fields.

Is your site exposed to CVE-2026-90392?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0016

Probability of exploitation

0.05%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/79347e42cfbc9e78872922e8f08a70609c9af82f https://git.kernel.org/stable/c/85cf991c881e7198be32be05a9daa2625390c8b3 https://git.kernel.org/stable/c/863f3ddd0b8ac65abfb50d3be0869268ac0e277b https://git.kernel.org/stable/c/a5c936ac904767fc1d943d40b0308bcb2ae2509b https://git.kernel.org/stable/c/d7d7208e2603b45724b684f4df73904fb347741e

Frequently Asked Questions

What is CVE-2026-90392? +

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF when reading bpf link info In bpf_link_show_fdinfo and bpf_link_get_info_by_fd, link->prog is accessed without holding any locks. If the prog is concurrently replaced via bpf_link_update, the old prog can be freed, leading to a potential UAF issue. Fix this by accessing link->prog under RCU protection to safely fetch the pointer and guarantee its lifetime while reading its fields. It has a CVSS v3.1 base score of 7.8 (HIGH).

How severe is CVE-2026-90392? +

CVE-2026-90392 has a CVSS v3.1 score of 7.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0016, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-90392? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-90392