CVE-2026-98060
Received Received - Intake

BPF RBTree Resilient Lock Bypass

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject resilient lock operations in rbtree callbacks __bpf_rbtree_add() keeps parent and link pointers live across calls to the program-supplied comparison callback. The verifier therefore requires the root's lock to remain held throughout the callback. The helper path enforces this rule for bpf_spin_lock() and bpf_spin_unlock(), but the resilient lock kfunc argument path does not. Since resilient locks may protect BPF rbtree roots, a callback can release the root lock and let another CPU remove and free the node referenced by the in-progress tree walk. The walk then resumes using freed pointers. Reject resilient lock kfuncs in an rbtree comparison callback, matching the existing policy for the spin lock helpers. Resilient-lock-protected trees remain valid when their comparison callbacks leave lock state alone.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98060
EUVD
EUVD-2026-86713

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves resilient lock operations in rbtree callbacks. The issue occurs in __bpf_rbtree_add() where parent and link pointers remain active during comparison callbacks. The verifier requires the root lock to stay held during these callbacks, but resilient lock kfuncs do not enforce this rule like bpf_spin_lock() does. This allows a callback to release the lock, enabling another CPU to remove and free a node while the tree walk is still in progress, leading to use-after-free errors.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) implementation and requires kernel-level inspection. Detection involves checking kernel logs for BPF-related errors or crashes, particularly during rbtree operations. Commands like dmesg | grep -i bpf or journalctl -k | grep -i bpf may reveal issues. Kernel version checks (uname -r) can confirm if your system is affected.

Impact Analysis

This vulnerability could allow an attacker to cause a denial-of-service condition or execute arbitrary code with kernel privileges. If exploited, it may lead to system crashes, data corruption, or unauthorized access to sensitive information. Systems running vulnerable Linux kernel versions with BPF (Berkeley Packet Filter) enabled are at risk.

Mitigation Strategies

Immediate mitigation requires updating the Linux kernel to a patched version that resolves this issue. Check your distribution's security advisories for kernel updates. If no patch is available, avoid using BPF programs that rely on resilient locks in rbtree callbacks until an update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98060. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart