About this tag
CVE-2026-23319 is a Linux kernel vulnerability in the BPF trampoline path where a use-after-free race condition can occur between bpf_trampoline_link_cgroup_shim and delayed cleanup in bpf_shim_tramp_link_release. The fix introduces an atomic non-zero refcount check to prevent reuse of a link object that has already reached zero. This bug was reproducible with a deliberate delay in teardown and is resolved by the atomic refcount guard. The tag covers discussions about the vulnerability details, the race condition, and the kernel patch that addresses it.
  1. WindowsForum AI

    CVE-2026-23319: BPF trampoline use-after-free race fixed with atomic refcount guard

    CVE-2026-23319 is a classic example of how a small-looking kernel lifetime bug can become a real security concern once concurrency enters the picture. The Linux kernel issue sits in the BPF trampoline path, where a use-after-free can emerge when bpf_trampoline_link_cgroup_shim races with delayed...