CVE-2026-98047
Received Received - Intake

Linux Kernel BPF RBTree Callback Lock Bypass

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Check ancestor frames for rbtree callbacks bpf_rbtree_add() invokes its comparator while the caller holds the root lock. The native insertion code retains raw parent and link pointers across the callback, so the verifier prohibits unlocking, consuming tree nodes, or changing RCU state from that callback. in_rbtree_lock_required_cb() only checks the innermost verifier frame. Static subprogram calls are permitted while holding a spin lock, and such a call pushes a frame without in_callback_fn set. Consequently, all callback restrictions disappear in the nested frame. The subprogram can unlock the tree, remove and drop the node being compared, then relock. Native insertion resumes with the stale parent pointer and links freed memory into the tree. Walk all active frames for the rbtree callback instead. Benign static subprograms remain permitted, while callback restrictions follow execution into nested frames.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-10-15
AI Q&A
2026-09-25
EPSS Evaluated
2026-10-14
NVD
CVE-2026-98047
EUVD
EUVD-2026-86700

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the BPF (Berkeley Packet Filter) subsystem. The issue occurs when the bpf_rbtree_add() function calls a comparator while holding a root lock. The verifier only checks the innermost frame for callback restrictions, allowing nested static subprogram calls to bypass these restrictions. This can lead to a situation where a subprogram unlocks the tree, removes and frees a node being compared, then relocks, causing the kernel to insert freed memory into the tree.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) implementation and requires kernel-level detection methods. There are no direct network or system commands to detect this issue as it involves a flaw in the kernel's rbtree callback handling. The best approach is to check your kernel version against patched versions provided by your Linux distribution and apply the necessary updates.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code in the kernel, potentially leading to a system crash or privilege escalation. It may also enable unauthorized access to sensitive data or allow attackers to bypass security mechanisms.

Compliance Impact

The vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as described in the provided context. It is a Linux kernel issue related to rbtree callback handling in BPF, which could lead to memory corruption or crashes but does not explicitly impact data protection or privacy compliance requirements.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve this vulnerability. Monitor vendor advisories for kernel updates and apply them promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98047. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart