CVE-2026-98813

Received Received - Intake

Use-After-Free in Linux Kernel BPF Subsystem

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Hold map BTF for the memory allocator destructor record bpf_ma_set_dtor() duplicates map->record so that the bpf_mem_alloc destructor can release the special fields of hash and rhash map elements once the allocator frees them for good. btf_record_dup() only acquires references on kernel and module BTF. Fields whose types live in the map BTF keep pointing into it: a kptr to a local type refers to map->btf, and a list_head or rb_root field carries a value_rec owned by the struct meta table of map->btf. That borrowed state can outlive the map. When RCU callbacks are still in flight, bpf_mem_alloc_destroy() copies the allocator and defers the final drain, together with the destructor context, to a workqueue. bpf_map_free() then frees map->record and drops the map's BTF reference as soon as map_free() returns. Once the program that loaded the BTF is gone as well, the BTF is freed while the worker still uses the duplicate. The worker dereferences it through btf_is_kernel() and btf_find_struct_meta() in bpf_obj_free_fields() when destroying elements that were freed under RCU, and through btf_is_kernel() in btf_record_free() when releasing the context itself: BUG: KASAN: slab-use-after-free in btf_is_kernel+0x19/0x30 Read of size 1 at addr ffff88811505dce8 by task kworker/u16:2/50 Workqueue: events_unbound free_mem_alloc_deferred Call Trace: btf_is_kernel+0x19/0x30 btf_record_free+0xc7/0xf0 htab_dtor_ctx_free+0x1a/0x30 free_mem_alloc_no_barrier+0x39/0x230 free_mem_alloc_deferred+0x2a/0x40 process_scheduled_works+0x5ce/0x9d0 worker_thread+0x42a/0x5e0 kthread+0x1f5/0x230 ret_from_fork+0x1dd/0x390 ret_from_fork_asm+0x1a/0x30 Allocated by task 358: __kmalloc_cache_noprof+0x287/0x510 btf_new_fd+0xf7/0x3d0 __sys_bpf+0x487/0x840 Freed by task 0: kfree+0x186/0x560 rcu_core+0x6f6/0xd40 Freeing a map that still holds more elements than the allocator's high watermark is enough to get there, because the bulk free during teardown queues the RCU callback that makes bpf_mem_alloc_destroy() defer. Non-preallocated hash maps and resizable hash maps both register the destructor and are affected alike. Keep one reference on the map BTF in the destructor context. Every non-kernel pointer in the duplicated record is either map->btf or memory owned by it, so a single reference covers kptrs, list heads, and rb roots, and mirrors what bpf_map_meta_alloc() does for the duplicated record of an inner map. Release it only after the duplicated record has been freed: the worker is preemptible and not in an RCU read-side critical section, so dropping the last reference first would let the BTF be freed while btf_record_free() still reads its fields.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98813

EUVD

EUVD-2026-103898

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	1df97a7453eec80c1912c2d0360290a3970a7671
Linux	Linux	1df97a7453eec80c1912c2d0360290a3970a7671
Linux	Linux	451a84a3ad3c897c03181af433e7c98640730f1f
Linux	Linux	51a17f0ce19c4ee2a25cf16c93490d509b1ebb0a
Linux	Linux	6.12.112
Linux	Linux	6.18.55
Linux	Linux	7.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in the BPF (Berkeley Packet Filter) subsystem. When a BPF map is freed, its associated BTF (BPF Type Format) data can be prematurely released while still in use by a workqueue handling deferred memory allocation destruction. This leads to a kernel crash due to accessing freed memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) implementation. Detection requires checking kernel logs for slab-use-after-free errors related to BPF operations. Monitor dmesg or system logs for messages like 'KASAN: slab-use-after-free in btf_is_kernel' or similar BPF-related errors.

Impact Analysis

This vulnerability can cause system instability, crashes, or potential privilege escalation if exploited. Systems using BPF maps, particularly non-preallocated or resizable hash maps, are at risk. Attackers could trigger the flaw to trigger kernel panics or execute arbitrary code in the kernel context.

Compliance Impact

This vulnerability is a Linux kernel memory management issue that could lead to use-after-free errors in BPF (Berkeley Packet Filter) components. It does not directly impact compliance with GDPR, HIPAA, or similar standards as it is a low-level system bug rather than a data protection or privacy violation. Compliance risks would only arise if this vulnerability were exploited to cause system instability or unauthorized access, which could indirectly lead to data breaches.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves this issue. Avoid using non-preallocated or resizable hash maps in BPF programs until the kernel is updated. Monitor kernel logs for any BPF-related errors after applying updates.

Hi! I’m here to help you understand CVE-2026-98813. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70