george0papasotiriou/cve-2026-22009-linux-ebpf-map-locking-race-use-after-freeSimulates the CVE-2026-22009 Linux eBPF map locking race, a kernel use-after-free leading to memory corruption and local privilege escalation.
// ebpf_map_uaf.c - Simulated concurrent map update/free
#include <stdio.h>
#include <stdlib.h>
#include <pthread.h>
#include <unistd.h>
void *map_data = NULL;
int map_freed = 0;
void *update_map(void *arg) {
// Simulate eBPF program updating map
if (!map_freed) {
*(char *)map_data = 'A';
}
return NULL;
}
void *free_map(void *arg) {
// Simulate user freeing map
sleep(1); // race window
free(map_data);
map_freed = 1;
return NULL;
}
int main() {
map_data = malloc(64);
pthread_t t1, t2;
pthread_create(&t1, NULL, update_map, NULL);
pthread_create(&t2, NULL, free_map, NULL);
pthread_join(t1, NULL);
pthread_join(t2, NULL);
return 0;
}
A race condition in the eBPF subsystem when a user‑space program frees a map while an eBPF program is concurrently updating it. The missing synchronisation leads to a use‑after‑free that can corrupt kernel memory or leak information.
Compile and run the simulation:
gcc -o ebpf_map_uaf ebpf_map_uaf.c -lpthread
./ebpf_map_uaf
The program exhibits a use‑after‑free (crash or corruption).