CVE-2026-98035
Received Received - Intake

BPF Object Field Handling in Linux Kernel

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields when recycling rhtab elements rhtab_map_update_existing() and rhtab_delete_elem() call bpf_obj_free_fields() when replacing or deleting a value. These map operations can run from BPF programs in NMI context, where releasing a referenced kptr or another complex field is not generally safe. Array and hash maps avoid that problem by cancelling only the asynchronous fields which can be stopped safely in the caller context. Other ownership state remains attached to the allocation until its memory allocator destructor performs the final cleanup. Use bpf_obj_cancel_fields() for the corresponding rhtab paths as well. This cancels timers, workqueues, and task work while allowing rhtab_mem_dtor() to release referenced kptrs when the allocation is eventually destroyed. [ kkd: Rebased, used direct helper calls, and rewrote the commit log ]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-10-15
AI Q&A
2026-09-25
EPSS Evaluated
2026-10-14
NVD
CVE-2026-98035
EUVD
EUVD-2026-86688

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of special fields when recycling rhtab elements in BPF programs. Functions like rhtab_map_update_existing() and rhtab_delete_elem() call bpf_obj_free_fields() during map operations, which can run in NMI context where releasing certain fields like kptr is unsafe. The issue arises because these functions do not cancel asynchronous fields safely before cleanup, potentially leading to unsafe memory operations.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) implementation and requires kernel-level inspection. Detection involves checking kernel logs for BPF-related errors or crashes, particularly during map operations in NMI context. Commands like dmesg, journalctl -k, or checking /var/log/kern.log may reveal issues. No direct network detection commands are applicable.

Impact Analysis

This vulnerability could lead to kernel memory corruption or crashes if exploited, particularly in systems running BPF programs. It may allow attackers with local access to trigger unsafe memory operations, potentially causing denial-of-service conditions or privilege escalation. Systems relying on BPF for networking, security, or monitoring could be affected.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel memory management issue in BPF (Berkeley Packet Filter) operations. Compliance implications would depend on how the vulnerability is exploited in a specific system configuration.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve this vulnerability. Monitor vendor advisories for kernel updates and apply them promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98035. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart