In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix effective prog array index with BPF_F_PREORDER

replace_effective_prog() and purge_effective_progs() located the slot in
the effective array by walking the program hlist and counting entries
linearly. That count does not match the array layout: compute_effective_
progs() places BPF_F_PREORDER programs at the front (ancestor cgroup
first, attach order within a cgroup) and the rest after them (descendant
cgroup first). So when a preorder program is present, the linear hlist
position no longer equals the program's index in the effective array.

For replace_effective_prog() (bpf_link_update()) this overwrote the
wrong slot, corrupting the effective order. For purge_effective_progs(),
it could dummy out a slot belonging to a different program and leave the
detached program in the array while bpf_prog_put() drops its reference,
i.e. a use-after-free.

Fix both by replaying compute_effective_progs()'s placement (including
the per-cgroup preorder reversal) in a shared effective_prog_pos()
helper. Identify the entry by its struct bpf_prog_list pointer rather
than by (prog, link) value, so the lookup resolves to exactly the
attachment the syscall selected even when the same bpf_prog is attached
to several cgroups in the hierarchy.

https://git.kernel.org/stable/c/41b4320b84fdafe1ab586b06453d30d50415db59

https://git.kernel.org/stable/c/525e408c27ae714e538b8c608c3a974df3ab6c92

https://git.kernel.org/stable/c/9697db03e010391c55ae75192cbdf30c5a72c114

https://git.kernel.org/stable/c/b584f107ab90222bd825dcb4c5977326ff684109

https://git.kernel.org/stable/c/f08aaee3152d0dfc578b3f2586932d82062701dd

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/cgroup.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bc8023ef3b11410682e5d4990e05e5bc2d3e1c94","lessThan":"525e408c27ae714e538b8c608c3a974df3ab6c92","versionType":"git","status":"affected"},{"version":"555c0b713ca83968d3c843cb15485b9ba3367b1b","lessThan":"41b4320b84fdafe1ab586b06453d30d50415db59","versionType":"git","status":"affected"},{"version":"4b82b181a26cff8bf7adc3a85a88d121d92edeaf","lessThan":"9697db03e010391c55ae75192cbdf30c5a72c114","versionType":"git","status":"affected"},{"version":"4b82b181a26cff8bf7adc3a85a88d121d92edeaf","lessThan":"b584f107ab90222bd825dcb4c5977326ff684109","versionType":"git","status":"affected"},{"version":"4b82b181a26cff8bf7adc3a85a88d121d92edeaf","lessThan":"f08aaee3152d0dfc578b3f2586932d82062701dd","versionType":"git","status":"affected"},{"version":"4707ad649cf662add3058bff47430817811b048d","versionType":"git","status":"affected"},{"version":"6.6.93","lessThan":"6.6.145","versionType":"semver","status":"affected"},{"version":"6.12.31","lessThan":"6.12.97","versionType":"semver","status":"affected"},{"version":"6.14.9","lessThan":"6.15","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/cgroup.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]