CVE-2026-98861
Received Received - Intake

Use-After-Free in Linux Kernel via fprobe

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching() unregister_fprobe() and unregister_fprobe_async() (used by BPF kprobe-multi) rely on standard RCU grace periods (synchronize_rcu() and call_rcu()) to wait until in-flight fprobe handlers complete before freeing the fprobe. However, if an fprobe handler executes while RCU is not watching (such as in the idle loop or nohz_full extended quiescent states), standard RCU does not track preemption-disabled sections. Consequently, synchronize_rcu() does not wait for those executions, which can lead to a use-after-free if the fprobe is freed immediately after unregistration. Ensure handlers exit early when !rcu_is_watching(). Furthermore, fprobe_fgraph_entry() and fprobe_ftrace_entry() previously used guard(rcu)() and rcu_read_lock(), which invoke lockdep on every hit under CONFIG_PROVE_LOCKING. This adds overhead and can cause lockdep recursion if probed functions interact with lockdep. Since rhltable_lookup() and rhl_for_each_entry_rcu() use rcu_dereference_all_check() (which checks rcu_read_lock_any_held()), holding preemption disabled via rcu_read_lock_sched_notrace() is fully valid and sufficient so long as rcu_is_watching() is true. Define and use guard(rcu_sched_notrace)() across fprobe_ftrace_entry(), fprobe_fgraph_entry(), and fprobe_return(). This eliminates fast-path rcu_read_lock() and lockdep overhead while guaranteeing safe grace period synchronization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98861
EUVD
EUVD-2026-103801

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
Linux Linux 56b4cfcf1518245493c60fd39c56978f508f1816
Linux Linux 657b594b2084b39a4bc6d8493aa2140cb00cea49
Linux Linux 657b594b2084b39a4bc6d8493aa2140cb00cea49
Linux Linux a4f6a9005ed6cfd360ef2520430927f05f92ffb0
Linux Linux 6.18.34
Linux Linux 7.0.11
Linux Linux 7.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of RCU (Read-Copy-Update) grace periods in fprobe operations. The issue occurs when fprobe handlers execute during RCU non-watching states like idle loops or nohz_full quiescent states. Standard RCU grace periods fail to track these executions, leading to potential use-after-free errors if the fprobe is freed immediately after unregistration. The fix introduces guard(rcu_sched_notrace) and checks rcu_is_watching() to ensure safe synchronization.

Detection Guidance

This vulnerability is specific to the Linux kernel's fprobe functionality and requires kernel-level detection. There are no standard network or system commands to directly detect this issue. Monitoring for kernel crashes, use-after-free errors, or RCU-related warnings in system logs may indicate exploitation or misconfiguration. Check kernel logs for RCU-related errors or fprobe-related crashes.

Impact Analysis

This vulnerability could lead to system crashes or instability if exploited, as it may cause use-after-free errors in the Linux kernel. Systems relying on BPF kprobe-multi or fprobe for tracing and monitoring could experience unexpected behavior or security issues due to improper RCU synchronization.

Mitigation Strategies

Apply the latest kernel patches or updates that address this vulnerability. If patches are unavailable, consider disabling fprobe or BPF kprobe-multi features if not required. Monitor kernel logs for RCU-related errors or crashes. Ensure your system runs a kernel version with the fix applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98861. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart