The Linux kernel's fprobe functionality was modified in commit 4346ba1604093 to register fprobe structures to an RCU-protected list but failed to wait for the RCU grace period during unregister_fprobe(). This omission could lead to a use-after-free condition if the fprobe was released immediately after unregistering, affecting fprobe event and sample module code. The vulnerability was addressed by adding synchronize_rcu() in unregister_fprobe() to ensure proper waiting for the RCU grace period before freeing. BPF usage of fprobe is unaffected because it unregisters and deallocates fprobe asynchronously via RCU callbacks. An asynchronous unregister function, unregister_fprobe_async(), was also introduced for BPF use cases.

The vulnerability could cause use-after-free conditions in the Linux kernel's fprobe code, potentially leading to kernel memory corruption or crashes when fprobe is released immediately after unregistering. However, BPF-related code paths are not impacted due to different deallocation methods. No known exploits in the wild have been reported.

A fix is available in the Linux kernel that adds synchronize_rcu() in unregister_fprobe() to wait for the RCU grace period. Users should update to a kernel version that includes this fix. For BPF users, the asynchronous unregister_fprobe_async() function is introduced and used to avoid this issue. Patch status is not explicitly stated in the input; therefore, check the vendor advisory or Linux kernel release notes for the exact fixed versions and apply updates accordingly.