CVE-2026-52910
published 2026-06-19CVE-2026-52910: In the Linux kernel, the following vulnerability has been resolved: bpf: Free reuseport cBPF prog after RCU grace period. Eulgyu Kim reported the splat below…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.10%
1.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
bpf: Free reuseport cBPF prog after RCU grace period.
Eulgyu Kim reported the splat below with a repro. [0]
The repro sets up a UDP reuseport group with a cBPF prog and
replaces it with a new one while another thread is sending
a UDP packet to the group.
The reuseport prog is freed by sk_reuseport_prog_free().
bpf_prog_put() is called for "e"BPF prog to destruct through
multiple stages while cBPF prog is freed immediately by
bpf_release_orig_filter() and bpf_prog_free().
If a reuseport prog is detached from the setsockopt() path
(reuseport_attach_prog() or reuseport_detach_prog()),
sk_reuseport_prog_free() is called without waiting for RCU
readers to complete, resulting in various bugs.
Let's defer freeing the reuseport cBPF prog after one RCU
grace period.
Note "e"BPF prog is safe as is unless the fast path starts
to touch fields destroyed in bpf_prog_put_deferred() and
__bpf_prog_put_noref().
[0]:
BUG: KASAN: vmalloc-out-of-bounds in reuseport_select_sock+0xedc/0x1220 net/core/sock_reuseport.c:596
Read of size 4 at addr ffffc9000051e004 by task slowme/10208
CPU: 6 UID: 1000 PID: 10208 Comm: slowme Not tainted 7.0.0-geb7ac95ff75e #32 PREEMPT(full)
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x240 mm/kasan/report.c:482
kasan_report+0x118/0x150 mm/kasan/report.c:595
reuseport_select_sock+0xedc/0x1220 net/core/sock_reuseport.c:596
udp4_lib_lookup2+0x3bc/0x950 net/ipv4/udp.c:495
__udp4_lib_lookup+0x768/0xe20 net/ipv4/udp.c:723
__udp4_lib_lookup_skb+0x297/0x390 net/ipv4/udp.c:752
__udp4_lib_rcv+0x1312/0x2620 net/ipv4/udp.c:2752
ip_protocol_deliver_rcu+0x282/0x440 net/ipv4/ip_input.c:207
ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:241
NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:3
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 538950a1b7527a0a52ccd9337e3fcd304f027f13 < 08264d5bba0bdd3a79bc2984fee09286aba0c4eb | 08264d5bba0bdd3a79bc2984fee09286aba0c4eb |
| linux | linux | >= 538950a1b7527a0a52ccd9337e3fcd304f027f13 < fec41484e7c2aa7ded44c541bba98872be937754 | fec41484e7c2aa7ded44c541bba98872be937754 |
| linux | linux | >= 538950a1b7527a0a52ccd9337e3fcd304f027f13 < c3e3fddda6b5d9ba505d218b4055e7d8a282ac57 | c3e3fddda6b5d9ba505d218b4055e7d8a282ac57 |
| linux | linux | >= 538950a1b7527a0a52ccd9337e3fcd304f027f13 < f8b8f1d4bb76098e87b8269a0631019648330e6d | f8b8f1d4bb76098e87b8269a0631019648330e6d |
| linux | linux | >= 538950a1b7527a0a52ccd9337e3fcd304f027f13 < 298db6167f81e9c470a57cf652e4e47757b4293e | 298db6167f81e9c470a57cf652e4e47757b4293e |
| linux | linux | >= 538950a1b7527a0a52ccd9337e3fcd304f027f13 < 87dfb977bdb6eaa47e9993a34e18f44970f88b1f | 87dfb977bdb6eaa47e9993a34e18f44970f88b1f |
| linux | linux | >= 538950a1b7527a0a52ccd9337e3fcd304f027f13 < 90e47dc5c572d1c73971ac51c7428803f42b78eb | 90e47dc5c572d1c73971ac51c7428803f42b78eb |
| linux | linux | >= 538950a1b7527a0a52ccd9337e3fcd304f027f13 < 18fc650ccd7fe3376eca89203668cfb8268f60df | 18fc650ccd7fe3376eca89203668cfb8268f60df |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 4.5 < 5.10.259 | 5.10.259 |
| linux | linux_kernel | >= 5.11 < 5.15.210 | 5.15.210 |
| linux | linux_kernel | >= 5.16 < 6.1.176 | 6.1.176 |
| linux | linux_kernel | >= 6.13 < 6.18.36 | 6.18.36 |
| linux | linux_kernel | >= 6.19 < 7.0.13 | 7.0.13 |
| linux | linux_kernel | >= 6.2 < 6.6.143 | 6.6.143 |
| linux | linux_kernel | >= 6.7 < 6.12.94 | 6.12.94 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 7.0.12 bpf sock_reuseport.c sk_reuseport_prog_free out-of-bounds (EUVD-2026-38034 / Nessus ID 321868)
vuldb·2026-06-22
CVE-2026-52910 [LOW] Linux Kernel up to 7.0.12 bpf sock_reuseport.c sk_reuseport_prog_free out-of-bounds (EUVD-2026-38034 / Nessus ID 321868)
A vulnerability marked as critical has been reported in Linux Kernel up to 7.0.12. This affects the function sk_reuseport_prog_free of the file net/core/sock_reuseport.c of the component bpf. Performing a manipulation results in out-of-bounds read.
This vulnerability is cataloged as CVE-2026-52910. The attack must originate from the local network. There is no exploit available.
It is suggested to upgrade the affected component.
GHSA
In the Linux kernel, the following vulnerability has been resolved: bpf: Free reuseport cBPF prog after RCU grace period.
ghsa_unreviewed·2026-06-19
CVE-2026-52910 In the Linux kernel, the following vulnerability has been resolved: bpf: Free reuseport cBPF prog after RCU grace period.
In the Linux kernel, the following vulnerability has been resolved:
bpf: Free reuseport cBPF prog after RCU grace period.
Eulgyu Kim reported the splat below with a repro. [0]
The repro sets up a UDP reuseport group with a cBPF prog and
replaces it with a new one while another thread is sending
a UDP packet to the group.
The reuseport prog is freed by sk_reuseport_prog_free().
bpf_prog_put() is called for "e"BPF prog to destruct through
multiple stages while cBPF prog is freed immediately by
bpf_release_orig_filter() and bpf_prog_free().
If a reuseport prog is detached from the setsockopt() path
(reuseport_attach_prog() or reuseport_detach_prog()),
sk_reuseport_prog_free() is called without waiting for RCU
readers to complete, resulting in various bugs.
Let's defer freeing the reusep
Red Hat
kernel: bpf: Free reuseport cBPF prog after RCU grace period
vendor_redhat·2026-06-19·CVSS 7.0
CVE-2026-52910 [HIGH] CWE-364 kernel: bpf: Free reuseport cBPF prog after RCU grace period
kernel: bpf: Free reuseport cBPF prog after RCU grace period
In the Linux kernel, the following vulnerability has been resolved:
bpf: Free reuseport cBPF prog after RCU grace period.
Eulgyu Kim reported the splat below with a repro. [0]
The repro sets up a UDP reuseport group with a cBPF prog and
replaces it with a new one while another thread is sending
a UDP packet to the group.
The reuseport prog is freed by sk_reuseport_prog_free().
bpf_prog_put() is called for "e"BPF prog to destruct through
multiple stages while cBPF prog is freed immediately by
bpf_release_orig_filter() and bpf_prog_free().
If a reuseport prog is detached from the setsockopt() path
(reuseport_attach_prog() or reuseport_detach_prog()),
sk_reuseport_prog_free() is called without waiting for RCU
readers to complete, r
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/08264d5bba0bdd3a79bc2984fee09286aba0c4ebhttps://git.kernel.org/stable/c/18fc650ccd7fe3376eca89203668cfb8268f60dfhttps://git.kernel.org/stable/c/298db6167f81e9c470a57cf652e4e47757b4293ehttps://git.kernel.org/stable/c/87dfb977bdb6eaa47e9993a34e18f44970f88b1fhttps://git.kernel.org/stable/c/90e47dc5c572d1c73971ac51c7428803f42b78ebhttps://git.kernel.org/stable/c/c3e3fddda6b5d9ba505d218b4055e7d8a282ac57https://git.kernel.org/stable/c/f8b8f1d4bb76098e87b8269a0631019648330e6dhttps://git.kernel.org/stable/c/fec41484e7c2aa7ded44c541bba98872be937754https://access.redhat.com/security/cve/CVE-2026-52910https://bugzilla.redhat.com/show_bug.cgi?id=2490779https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52910.json
2026-06-19
Published