CVE-2026-98789
Received Received - Intake

Memory Leak in Linux Kernel BPF Subsystem

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix objects stuck in free_by_rcu_ttrace do_call_rcu_ttrace() returns early when call_rcu_ttrace_in_progress is set and leaves the objects in free_by_rcu_ttrace. __free_rcu() frees waiting_for_gp_ttrace only and clears the flag. Hence the objects that free_bulk() or __free_by_rcu() added while RCU tasks trace GP was in flight stay in free_by_rcu_ttrace until free_bulk() or alloc_bulk() is called for the same bpf_mem_cache again, which may never happen. The number of such objects is not bounded. Turn call_rcu_ttrace_in_progress into three states: 0 - idle 1 - __free_rcu() is queued 2 - __free_rcu() is queued and free_by_rcu_ttrace got more objects since do_call_rcu_ttrace() sets 2. __free_rcu() does cmpxchg(1 -> 0) and starts the next GP when it fails. It cannot clear the flag first and check free_by_rcu_ttrace later, since bpf_mem_alloc_destroy() frees bpf_mem_cache without waiting for RCU callbacks when the flag is zero. Now __free_rcu() queues itself, so the one that didn't see 'draining' may do call_rcu_tasks_trace() after rcu_barrier_tasks_trace() in free_mem_alloc(). Queue it under rcu_read_lock() and do synchronize_rcu() before the barriers. Calling rcu_barrier_tasks_trace() twice works too, but creating and destroying hash maps in a loop on many cpus slows down to one free_mem_alloc() per GP and kworkers pile up.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98789
EUVD
EUVD-2026-103874

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Linux Linux 8d5a8011b35d387c490a5c977b1d9eb4798aa071
Linux Linux 8d5a8011b35d387c490a5c977b1d9eb4798aa071
Linux Linux 6.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where objects in the BPF memory allocator get stuck in a cleanup queue. The issue occurs because the RCU (Read-Copy-Update) trace garbage collection mechanism fails to properly track and free objects when memory caches are being destroyed. The system incorrectly assumes all objects are freed, leading to potential memory leaks.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) subsystem and requires kernel-level inspection. Detection involves checking kernel logs for RCU (Read-Copy-Update) related errors or BPF memory allocation issues. Commands like dmesg | grep -i 'rcu' or journalctl -k | grep -i 'bpf' may reveal related errors. However, no direct detection commands are provided in the context.

Impact Analysis

This could lead to memory exhaustion if many objects accumulate over time. Systems running BPF programs or using BPF-based tools may experience crashes, performance degradation, or instability due to unreleased memory. It primarily affects systems with frequent BPF memory allocation and deallocation operations.

Mitigation Strategies

Mitigation requires updating the Linux kernel to a patched version that resolves the BPF memory leak issue. Check your distribution's security advisories for kernel updates. If immediate patching is not possible, consider disabling BPF-related features if not critical to operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98789. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart