CVE-2026-53089: Linux Kernel BPF Offload Use-After-Free During Namespace Teardown

Technical summary

The vulnerability resides in bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns() functions, which are called when userspace queries information about offloaded BPF resources via netlink. These functions retrieve the network namespace of the netdev backing the offloaded resource using get_net(dev_net(offmap->netdev)). While rtnl_lock and bpf_devs_lock protect the netdev pointer's validity, they do not prevent the associated network namespace's refcount from reaching zero during concurrent netns destruction. When refcount reaches zero, get_net() invokes refcount_t increment-on-zero, triggering a kernel warning and potential use-after-free. The resolution uses maybe_get_net(), which employs refcount_inc_not_zero() to safely detect dead refcounts and return NULL, allowing the query to fail with -ENOENT instead of corrupting memory.

Business impact

A local attacker with unprivileged user privileges can trigger this vulnerability to destabilize kernel memory management, potentially leading to denial of service or information disclosure. The vulnerability requires local access and coordination of BPF offload queries with network namespace teardown—a race condition that may be difficult to exploit reliably but feasible in multi-tenant container environments or systems where users can create network namespaces. Affected organizations running BPF-based monitoring, firewalling, or load-balancing systems (such as Cilium, Calico, or custom eBPF telemetry) on vulnerable kernels face availability risk.

Affected systems

The Linux kernel is affected. The vulnerability is present in BPF subsystem code responsible for offloaded map and program information retrieval, affecting kernels with BPF offload support enabled. Distributions and systems using BPF for XDP (Express Data Path), tc (traffic control) offload, or other accelerated BPF execution paths are in scope. Specific kernel version ranges and patch status should be verified against the Linux kernel security advisories and your distribution's patch tracker.

Exploitability

Exploitation requires local system access with unprivileged user privileges—the vulnerability cannot be triggered remotely. An attacker must craft concurrent BPF information queries (via netlink) and initiate network namespace destruction to hit the race condition window. While the race is timing-dependent and may require multiple attempts, it is plausible in scenarios with high namespace churn (container orchestration, testing frameworks) or on systems with predictable scheduler behavior. No public exploit code or KEV status indicates this has not yet been weaponized in the wild at publication time.

Remediation

Apply the kernel patch that replaces get_net() with maybe_get_net() in both bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns(). This ensures safe namespace reference counting during concurrent teardown. Verify the patch against your kernel version and distribution advisory to identify the correct stable backport or update. If immediate patching is not feasible, consider disabling BPF offload features (e.g., disabling XDP or tc offload in driver and kernel configuration) until patched.

Patch guidance

Check your Linux distribution's security advisory portal and the Linux kernel stable tree for the backported fix. Most major distributions (Ubuntu, RHEL, Debian, SUSE) will release patched kernel versions; prioritize applying these updates to systems with BPF offload enabled. Kernel maintainers typically backport critical fixes to multiple stable branches, so verify which branch(es) your deployment follows. After patching, validate using kernel logs or runtime introspection to confirm the maybe_get_net() codepath is in place.

Detection guidance

Monitor kernel logs for refcount_t warnings ("addition on 0; use-after-free") or traces mentioning bpf_map_offload_info_fill_ns or bpf_prog_offload_info_fill_ns during namespace teardown scenarios. Use eBPF or kprobes to observe calls to these functions during simultaneous BPF info queries and netns deletion. In containers or orchestration environments, correlate kernel panics or hangs with high rates of namespace creation/destruction or BPF program lifecycle changes.

Why prioritize this

A CVSS score of 7.8 (HIGH) reflects local-only attack vector and high impact on confidentiality, integrity, and availability. While not remotely exploitable, the vulnerability affects core kernel subsystems and may be triggered in multi-tenant or container-heavy deployments. Organizations with active BPF offload usage or continuous namespace churn should prioritize patching; others may schedule updates within standard maintenance windows.

Risk score, explained

The CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector reflects: Local Attack Vector (AV:L) — no remote exploitation; Low Attack Complexity (AC:L) — no special setup beyond user-level access; Low Privileges Required (PR:L) — unprivileged user can trigger; No User Interaction (UI:N) — attacker-controlled; Unchanged Scope (S:U) — impact confined to vulnerable system; High C/I/A — memory corruption with confidentiality and availability impact. The score of 7.8 appropriately captures a serious local memory-safety issue without remote reach.

Frequently asked questions