CVE-2026-90317 addresses a use-after-free vulnerability in the Linux kernel's BPF implementation. In sleepable BPF programs, a spin lock can be the sole RCU protection for a kernel pointer (kptr). The final bpf_spin_unlock() call ends this protection, but the verifier erroneously keeps the pointer valid. Consequently, another CPU may free the object before the pointer is used, leading to a use-after-free condition demonstrated by a capability-limited proof of concept triggering a task_struct use-after-free in __bpf_get_task_stack(). The patch records whether the program is in an RCU-protected context before releasing the lock and invalidates RCU-protected pointers only when the unlock leaves the final such context, preserving valid pointers in other cases.

This vulnerability allows a local attacker with limited privileges to cause a use-after-free in kernel memory, potentially leading to arbitrary code execution or system compromise. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability. However, exploitation requires local access and involves kernel BPF programs.

A fix is available that properly invalidates RCU pointers after the final spin unlock in sleepable BPF programs. Users should apply the official Linux kernel patch that addresses this issue. No additional mitigation is indicated by the vendor advisory.