CVE-2026-98036
Received Received - Intake

BPF Special Fields Preservation Flaw in Linux Kernel

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve special fields in recycled rhtab elements rhtab_map_update_elem() initializes special fields after obtaining an element from bpf_mem_cache_alloc(). The allocator can return a fresh, zeroed unit, or recycle one from its RCU-pending lists before the registered destructor has run. A BPF program can retain a map-value pointer after deleting its element and initialize and arm a timer through that pointer. If the deleted unit is recycled, check_and_init_map_value() clears the only pointer to the timer. Neither a later deletion nor rhtab_mem_dtor() can then cancel it, and the callback can run with its key and value pointing into freed memory. Do not reinitialize special fields on insertion. Fresh allocator units are already zeroed. For recycled units, the special fields are ownership state that must remain visible to the eventual destructor. copy_map_value() already skips those fields, matching the non-preallocated hash-map path and the lifecycle established by commit 275c30bcee66 ("bpf: Don't reinit map value in prealloc_lru_pop"). [ kkd: Split out the fix and rewrote the commit log ]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98036
EUVD
EUVD-2026-86689

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of special fields in recycled elements of a BPF (Berkeley Packet Filter) hash table. When a BPF program deletes an element and retains a pointer to it, the element may be recycled before the destructor runs. This can lead to a timer callback executing with invalid memory access, as the special fields (like timer pointers) are not preserved during recycling.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF subsystem and requires kernel-level inspection. Detection involves checking kernel logs for BPF-related errors or examining kernel memory states. Commands like dmesg, journalctl -k, or bpftrace may help identify unusual BPF map behaviors. No direct network detection commands are applicable.

Impact Analysis

This vulnerability could allow a local attacker to cause a denial-of-service (DoS) condition or potentially execute arbitrary code in the kernel. It may lead to system instability, crashes, or unauthorized access if exploited.

Mitigation Strategies

Apply the latest Linux kernel security patches to address the BPF subsystem flaw. Avoid using BPF maps in untrusted environments until patched. Monitor kernel logs for BPF-related crashes or memory corruption signs. Restart affected systems after patching to ensure fixes are active.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98036. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart