---
id: CVE-2026-23319
title: 'bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim

  The root cause of this bug is that when 'bpf_link_put' reduces the
  refcount of 'shim_link->link.link' to zero, …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e <
    529e685e522b9d7fb379dbe6929dcdf520e34c8c
  - >-
    Linux >= 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e <
    9b02c5c4147f8af8ed783c8deb5df927a55c3951
  - >-
    Linux >= 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e <
    cfcfa0ca0212162aa472551266038e8fd6768cff
  - >-
    Linux >= 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e <
    3eeddb80191f7626ec1ef742bfff51ec3b0fa5c2
  - >-
    Linux >= 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e <
    4e8a0005d633a4adc98e3b65d5080f93b90d356b
  - >-
    Linux >= 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e <
    56145d237385ca0e7ca9ff7b226aaf2eb8ef368b
  - Linux 6.0
published: '2026-03-25'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T08:45:34.382Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23319'
references:
  - url: 'https://git.kernel.org/stable/c/529e685e522b9d7fb379dbe6929dcdf520e34c8c'
  - url: 'https://git.kernel.org/stable/c/9b02c5c4147f8af8ed783c8deb5df927a55c3951'
  - url: 'https://git.kernel.org/stable/c/cfcfa0ca0212162aa472551266038e8fd6768cff'
  - url: 'https://git.kernel.org/stable/c/3eeddb80191f7626ec1ef742bfff51ec3b0fa5c2'
  - url: 'https://git.kernel.org/stable/c/4e8a0005d633a4adc98e3b65d5080f93b90d356b'
  - url: 'https://git.kernel.org/stable/c/56145d237385ca0e7ca9ff7b226aaf2eb8ef368b'
tags:
  - cve.org
epss: 0.00126
epssPercentile: 0.02586
ingestedAt: '2026-09-08T15:33:26.993Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim

The root cause of this bug is that when 'bpf_link_put' reduces the
refcount of 'shim_link->link.link' to zero, the resource is considered
released but may still be referenced via 'tr->progs_hlist' in
'cgroup_shim_find'. The actual cleanup of 'tr->progs_hlist' in
'bpf_shim_tramp_link_release' is deferred. During this window, another
process can cause a use-after-free via 'bpf_trampoline_link_cgroup_shim'.

Based on Martin KaFai Lau's suggestions, I have created a simple patch.

To fix this:
   Add an atomic non-zero check in 'bpf_trampoline_link_cgroup_shim'.
   Only increment the refcount if it is not already zero.

Testing:
   I verified the fix by adding a delay in
   'bpf_shim_tramp_link_release' to make the bug easier to trigger:

static void bpf_shim_tramp_link_release(struct bpf_link *link)
{
	/* ... */
	if (!shim_link->trampoline)
		return;

+	msleep(100);
	WARN_ON_ONCE(bpf_trampoline_unlink_prog(&shim_link->link,
		shim_link->trampoline, NULL));
	bpf_trampoline_put(shim_link->trampoline);
}

Before the patch, running a PoC easily reproduced the crash(almost 100%)
with a call trace similar to KaiyanM's report.
After the patch, the bug no longer occurs even after millions of
iterations.

## Affected

- `Linux >= 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e < 529e685e522b9d7fb379dbe6929dcdf520e34c8c`
- `Linux >= 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e < 9b02c5c4147f8af8ed783c8deb5df927a55c3951`
- `Linux >= 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e < cfcfa0ca0212162aa472551266038e8fd6768cff`
- `Linux >= 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e < 3eeddb80191f7626ec1ef742bfff51ec3b0fa5c2`
- `Linux >= 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e < 4e8a0005d633a4adc98e3b65d5080f93b90d356b`
- `Linux >= 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e < 56145d237385ca0e7ca9ff7b226aaf2eb8ef368b`
- `Linux 6.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.