Commit 24f90fa3994b for kernel

commit 24f90fa3994b992d1a09003a3db2599330a5232a
Author: Florian Westphal <fw@strlen.de>
Date:   Tue Mar 17 12:23:08 2026 +0100

    netfilter: bpf: defer hook memory release until rcu readers are done

    Yiming Qian reports UaF when concurrent process is dumping hooks via
    nfnetlink_hooks:

    BUG: KASAN: slab-use-after-free in nfnl_hook_dump_one.isra.0+0xe71/0x10f0
    Read of size 8 at addr ffff888003edbf88 by task poc/79
    Call Trace:
     <TASK>
     nfnl_hook_dump_one.isra.0+0xe71/0x10f0
     netlink_dump+0x554/0x12b0
     nfnl_hook_get+0x176/0x230
     [..]

    Defer release until after concurrent readers have completed.

    Reported-by: Yiming Qian <yimingqian591@gmail.com>
    Fixes: 84601d6ee68a ("bpf: add bpf_link support for BPF_NETFILTER programs")
    Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/net/netfilter/nf_bpf_link.c b/net/netfilter/nf_bpf_link.c
index 6f3a6411f4af..c20031891b86 100644
--- a/net/netfilter/nf_bpf_link.c
+++ b/net/netfilter/nf_bpf_link.c
@@ -170,7 +170,7 @@ static int bpf_nf_link_update(struct bpf_link *link, struct bpf_prog *new_prog,

 static const struct bpf_link_ops bpf_nf_link_lops = {
 	.release = bpf_nf_link_release,
-	.dealloc = bpf_nf_link_dealloc,
+	.dealloc_deferred = bpf_nf_link_dealloc,
 	.detach = bpf_nf_link_detach,
 	.show_fdinfo = bpf_nf_link_show_info,
 	.fill_link_info = bpf_nf_link_fill_link_info,