CVE-2026-52910

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: bpf: Free reuseport cBPF prog after RCU grace period. Eulgyu Kim reported the splat below with a repro. [0] The repro sets up a UDP reuseport group with a cBPF prog and replaces it with a new one while another thread is sending a UDP packet to the group. The reuseport prog is freed by sk_reuseport_prog_free(). bpf_prog_put() is called for "e"BPF prog to destruct through multiple stages while cBPF prog is freed immediately by bpf_release_orig_filter() and bpf_prog_free(). If a reuseport prog is detached from the setsockopt()...

Affected product and versions

Product

Linux Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6

Affected versions

>= 538950a1b7527a0a52ccd9337e3fcd304f027f13 < 08264d5bba0bdd3a79bc2984fee09286aba0c4eb, >= 538950a1b7527a0a52ccd9337e3fcd304f027f13 < fec41484e7c2aa7ded44c541bba98872be937754, >= 538950a1b7527a0a52ccd9337e3fcd304f027f13 < c3e3fddda6b5d9ba505d218b4055e7d8a282ac57, >= 538950a1b7527a0a52ccd9337e3fcd304f027f13 < f8b8f1d4bb76098e87b8269a0631019648330e6d, >= 538950a1b7527a0a52ccd9337e3fcd304f027f13 < 298db6167f81e9c470a57cf652e4e47757b4293e, >= 538950a1b7527a0a52ccd9337e3fcd304f027f13 < 87dfb977bdb6eaa47e9993a34e18f44970f88b1f, >= 538950a1b7527a0a52ccd9337e3fcd304f027f13 < 90e47dc5c572d1c73971ac51c7428803f42b78eb, >= 538950a1b7527a0a52ccd9337e3fcd304f027f13 < 18fc650ccd7fe3376eca89203668cfb8268f60df, >= 4.5, >= 4.5 < 5.10.259, >= 5.11 < 5.15.210, >= 5.16 < 6.1.176, >= 6.2 < 6.6.143, >= 6.7 < 6.12.94, >= 6.13 < 6.18.36, >= 6.19 < 7.0.13, 7.1

Fixed versions

5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-125, CWE-364