CVE-2026-53089 is a use-after-free vulnerability in the Linux kernel's BPF offload info query functions (bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns()). These functions obtain the network namespace using get_net(dev_net(offmap->netdev)), but if the network namespace's refcount has reached zero during teardown, get_net() increments a zero refcount, causing a use-after-free. Although locking ensures the netdev pointer remains valid, it does not prevent the netns refcount from reaching zero. The vulnerability is fixed by switching to maybe_get_net(), which only increments the refcount if it is non-zero and returns NULL otherwise, causing the caller to return an error and avoid the use-after-free.

Successful exploitation could lead to memory corruption due to use-after-free, potentially allowing privilege escalation or denial of service. The CVSS vector indicates local attack vector with low complexity, requiring low privileges and no user interaction, with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves replacing get_net() with maybe_get_net() to prevent use-after-free. Until an official patch is available, avoid querying offloaded BPF map or program info in environments where network namespaces may be destroyed concurrently.