CVE-2026-53089: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-53089 is a use-after-free vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem, specifically in the offloaded map/program info query path. The flaw was published on June 24, 2026, and affects Linux kernel versions from 4.16 onward, up to the patched commits. The vulnerability arises when bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns() call get_net() on a network namespace whose refcount has already reached zero during concurrent teardown. Feedly estimates this as a Medium severity issue, with an EPSS score of approximately 0.145% (GitHub Advisory).

The root cause is a race condition (CWE-416: Use After Free) in the Linux kernel's BPF offload subsystem. When querying info for an offloaded BPF map or program, the functions bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns() call get_net(dev_net(offmap->netdev)) to obtain a reference to the associated network namespace. If the network namespace is concurrently being destroyed and its refcount has already reached zero, get_net() attempts a refcount_t increment on 0, triggering a use-after-free condition with the kernel message refcount_t: addition on 0; use-after-free. While rtnl_lock and bpf_devs_lock protect the netdev pointer from becoming invalid, they do not prevent the netns refcount from reaching zero. The fix replaces get_net() with maybe_get_net(), which uses refcount_inc_not_zero() and safely returns NULL (causing the caller to return -ENOENT) when the namespace is being destroyed (GitHub Advisory).

A local user with the ability to query BPF map or program information can trigger a kernel panic and crash the system by racing the query against network namespace destruction, resulting in a denial of service. The vulnerability's impact is limited to availability — there is no evidence of confidentiality or integrity compromise. The attack requires local access and the ability to perform BPF info queries, limiting the blast radius to systems where unprivileged or semi-privileged users can interact with offloaded BPF objects (GitHub Advisory).

• Logs: Kernel log messages containing refcount_t: addition on 0; use-after-free in dmesg or /var/log/kern.log, potentially accompanied by a kernel BUG or panic trace referencing bpf_map_offload_info_fill_ns or bpf_prog_offload_info_fill_ns.
• Process: Unusual or repeated invocations of BPF syscalls (e.g., BPF_OBJ_GET_INFO_BY_FD) from local processes coinciding with network namespace deletion events.
• System: Unexpected kernel panics or system reboots on hosts running offloaded BPF programs/maps in environments with frequent network namespace creation and destruction (e.g., container orchestration platforms).

Update the Linux kernel to a version containing the fix commits: a51e7fbe94a87e236631a83973d4f558310b2cd2 or a0c584fc18056709c8e047a82a6045d6c209f4ce, which replace get_net() with maybe_get_net() in the affected BPF offload info fill functions. Stable kernel versions 7.0.10 and 7.1 (and later) are confirmed unaffected. As a workaround, restrict BPF query operations to privileged users only (e.g., via kernel.unprivileged_bpf_disabled=1 sysctl) to limit exposure to the vulnerable code path (GitHub Advisory, Kernel Patch 1, Kernel Patch 2).