---
id: CVE-2026-23319
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim

  The root cause of this bug is that when 'bpf_link_put' reduces the
  refcount of 'shim_link->link.link' to zero, …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim

  The root cause of this bug is that when 'bpf_link_put' reduces the
  refcount of 'shim_link->link.link' to zero, …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-416
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 6.0.1, < 6.1.167'
  - 'linux_kernel >= 6.2, < 6.6.130'
  - 'linux_kernel >= 6.7, < 6.12.77'
  - 'linux_kernel >= 6.13, < 6.18.17'
  - 'linux_kernel >= 6.19, < 6.19.7'
  - linux_kernel = 6.0
  - linux_kernel = 7.0
patched:
  - linux_kernel 6.19.7
published: '2026-03-25'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T02:18:49.593'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-23319'
references:
  - url: 'https://git.kernel.org/stable/c/3eeddb80191f7626ec1ef742bfff51ec3b0fa5c2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4e8a0005d633a4adc98e3b65d5080f93b90d356b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/529e685e522b9d7fb379dbe6929dcdf520e34c8c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/56145d237385ca0e7ca9ff7b226aaf2eb8ef368b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9b02c5c4147f8af8ed783c8deb5df927a55c3951'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cfcfa0ca0212162aa472551266038e8fd6768cff'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-019113.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-082556.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-457936.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-784472.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00136
epssPercentile: 0.0304
ingestedAt: '2026-09-08T15:33:26.993Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim

The root cause of this bug is that when 'bpf_link_put' reduces the
refcount of 'shim_link->link.link' to zero, the resource is considered
released but may still be referenced via 'tr->progs_hlist' in
'cgroup_shim_find'. The actual cleanup of 'tr->progs_hlist' in
'bpf_shim_tramp_link_release' is deferred. During this window, another
process can cause a use-after-free via 'bpf_trampoline_link_cgroup_shim'.

Based on Martin KaFai Lau's suggestions, I have created a simple patch.

To fix this:
   Add an atomic non-zero check in 'bpf_trampoline_link_cgroup_shim'.
   Only increment the refcount if it is not already zero.

Testing:
   I verified the fix by adding a delay in
   'bpf_shim_tramp_link_release' to make the bug easier to trigger:

static void bpf_shim_tramp_link_release(struct bpf_link *link)
{
	/* ... */
	if (!shim_link->trampoline)
		return;

+	msleep(100);
	WARN_ON_ONCE(bpf_trampoline_unlink_prog(&shim_link->link,
		shim_link->trampoline, NULL));
	bpf_trampoline_put(shim_link->trampoline);
}

Before the patch, running a PoC easily reproduced the crash(almost 100%)
with a call trace similar to KaiyanM's report.
After the patch, the bug no longer occurs even after millions of
iterations.

## Affected

- `linux_kernel >= 6.0.1, < 6.1.167`
- `linux_kernel >= 6.2, < 6.6.130`
- `linux_kernel >= 6.7, < 6.12.77`
- `linux_kernel >= 6.13, < 6.18.17`
- `linux_kernel >= 6.19, < 6.19.7`
- `linux_kernel = 6.0`
- `linux_kernel = 7.0`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.19.7`