The Linux kernel's BPF subsystem contained a use-after-free vulnerability in bpf_trampoline_link_cgroup_shim caused by a delayed cleanup of a linked resource's reference list. When bpf_link_put reduces the reference count to zero, the resource is considered released, but it may still be referenced via tr->progs_hlist in cgroup_shim_find. This deferred cleanup allows a race condition where another process can trigger a use-after-free. The fix involves adding an atomic check to ensure the reference count is non-zero before incrementing it, preventing use-after-free during the cleanup window. The vulnerability affects multiple Linux kernel versions prior to 6.8.0-1064.72 and related builds. Official patches have been released by Ubuntu in security notices USN-8567-1 and USN-8574-1.

Successful exploitation of this use-after-free vulnerability could allow a local attacker with limited privileges to execute arbitrary code or cause a denial of service by corrupting kernel memory. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability. However, no known exploits are currently reported in the wild.

A patch is available and has been released by the vendor in official Ubuntu security updates (USN-8567-1 and USN-8574-1). Users should apply the kernel updates and reboot their systems to fully mitigate this vulnerability. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required after updating. No additional mitigation steps are indicated by the vendor advisory.