CVE-2026-23319: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23319 is a use-after-free (UAF) vulnerability in the Linux kernel's BPF subsystem, specifically within the bpf_trampoline_link_cgroup_shim function. It affects Linux kernel versions 6.0.1 through 6.1.166, 6.2 through 6.6.129, 6.7 through 6.12.76, 6.13 through 6.18.16, 6.19 through 6.19.6, and 7.0 release candidates rc1–rc7. The vulnerability was published on March 25, 2026, with patches released across multiple stable kernel branches. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Feedly).

The root cause is a race condition classified as CWE-416 (Use After Free) and CWE-825 (Expired Pointer Dereference). When bpf_link_put reduces the reference count of shim_link->link.link to zero, the resource is considered released but may still be referenced via tr->progs_hlist in cgroup_shim_find. The deferred cleanup of tr->progs_hlist in bpf_shim_tramp_link_release creates a window during which another process can trigger a UAF through bpf_trampoline_link_cgroup_shim. The fix adds an atomic non-zero check before incrementing the refcount, ensuring the refcount is only incremented if the resource has not already been freed (Red Hat Advisory, Feedly).

A local attacker with BPF capabilities can exploit this vulnerability to cause a kernel crash (denial of service) or potentially achieve arbitrary code execution with high confidentiality, integrity, and availability impact. The vulnerability was reliably reproduced with near 100% success rate in testing environments using proof-of-concept code with an artificial delay injected into bpf_shim_tramp_link_release. Exploitation is limited to local access with low privileges, but successful exploitation could enable privilege escalation or lateral movement within the affected system (Feedly, Red Hat Advisory).

Upgrade to one of the following patched Linux kernel versions: 6.1.167+, 6.6.130+, 6.12.77+, 6.18.17+, 6.19.7+, or 7.0-rc3+. Patches are also available for Microsoft's Azure Linux kernel (azl3_kernel_6.6.126.1-1). As a temporary workaround where patching is not immediately possible, restrict BPF program execution privileges to trusted users only (e.g., via kernel.unprivileged_bpf_disabled=1 sysctl), or disable BPF functionality entirely where not required. Distribution-specific updates are available from Red Hat, SUSE, Debian, and Amazon Linux (Red Hat Advisory, SUSE Advisory, Amazon Linux).

Red Hat published a security advisory and Bugzilla entry tracking the issue, and SUSE and Debian have both issued kernel update advisories addressing CVE-2026-23319 (Red Hat Advisory, SUSE Advisory). Microsoft acknowledged the vulnerability in the context of its Azure Linux kernel (Microsoft MSRC). No significant public researcher commentary or social media discussion has been identified beyond standard vulnerability tracking.