CVE-2026-90317

In the Linux kernel, the following vulnerability has been resolved:

bpf: Invalidate RCU pointers after final spin unlock

In a sleepable BPF program, a spin lock can provide the only RCU protection

for a kptr. The final bpf_spin_unlock() ends that protection, but the

verifier leaves the pointer valid. Another CPU can then free the object

before the pointer is used. A capability-limited runtime PoC triggered a

task_struct use-after-free in __bpf_get_task_stack().

Record whether the program is in an RCU-protected context before releasing

the lock. Invalidate RCU-protected pointers only when the unlock leaves the

final such context. This preserves valid pointers in non-sleepable programs

and inside an explicit RCU read-side section.