Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2026-90392 Details

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF when reading bpf link info In bpf_link_show_fdinfo and bpf_link_get_info_by_fd, link->prog is accessed without holding any locks. If the prog is concurrently replaced via bpf_link_update, the old prog can be freed, leading to a potential UAF issue. Fix this by accessing link->prog under RCU protection to safely fetch the pointer and guarantee its lifetime while reading its fields.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: kernel.orgCVSS-B:7.8 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://git.kernel.org/stable/c/79347e42cfbc9e78872922e8f08a70609c9af82f kernel.org
https://git.kernel.org/stable/c/85cf991c881e7198be32be05a9daa2625390c8b3 kernel.org
https://git.kernel.org/stable/c/863f3ddd0b8ac65abfb50d3be0869268ac0e277b kernel.org
https://git.kernel.org/stable/c/a5c936ac904767fc1d943d40b0308bcb2ae2509b kernel.org
https://git.kernel.org/stable/c/d7d7208e2603b45724b684f4df73904fb347741e kernel.org

Weakness Enumeration

No weakness enumeration is available for this CVE.

Affected Products

No affected product data is available for this CVE.

Change History

2 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2026-90392
NVD Published Date:
Sep 17, 2026
NVD Last Modified:
Sep 18, 2026
Source:
kernel.org
CVE-2026-90392 Details - Not Deferred