CVE-2026-98033

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98033", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:19:56.070Z", "datePublished": "2026-09-25T10:23:48.761Z", "dateUpdated": "2026-10-21T12:54:07.398Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:54:07.398Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Preserve inner map identity in callback frames\n\nCallback frame constructors initialize map-typed argument registers with\n__mark_reg_known_zero() and then restore map_ptr. This clears map_uid,\nwhich is the only field distinguishing inner maps that share an\ninner_map_meta template.\n\nWhen a timer callback invokes bpf_for_each_map_elem() on a second inner\nmap, both the saved first map and the second map value can reach the nested\ncallback as the same template with map_uid zero. bpf_timer_init() then\naccepts pairing the timer from the second map with the first map.\n\nThe runtime records the first map in the timer without taking a reference.\nFreeing that map does not find the timer stored in the second map, so a\nlater timer callback dereferences the freed map.\n\nCopy map_uid from the same caller register as map_ptr when constructing\nfor-each, timer/workqueue, and task-work callback arguments. The existing\nidentity check can then reject mismatched inner maps while allowing a\ncallback value to be paired with its actual map."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/verifier.c"], "versions": [{"version": "69c087ba6225b574afb6e505b72cb75242a3d844", "lessThan": "cf85e4f94d7feef8b3c4c90dbe2468595a48393b", "status": "affected", "versionType": "git"}, {"version": "69c087ba6225b574afb6e505b72cb75242a3d844", "lessThan": "166221c52d3ca332f8699a854efca8e2704bb137", "status": "affected", "versionType": "git"}, {"version": "69c087ba6225b574afb6e505b72cb75242a3d844", "lessThan": "08b534bafdd9de65b6374474a8fe719c90eb3b01", "status": "affected", "versionType": "git"}, {"version": "69c087ba6225b574afb6e505b72cb75242a3d844", "lessThan": "66ff2eff093d2a0838f39c713eeb590bc0946c2a", "status": "affected", "versionType": "git"}, {"version": "69c087ba6225b574afb6e505b72cb75242a3d844", "lessThan": "b90c5d770dad910fb89e6c1b15052a8a1e8db752", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/verifier.c"], "versions": [{"version": "5.13", "status": "affected"}, {"version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/cf85e4f94d7feef8b3c4c90dbe2468595a48393b"}, {"url": "https://git.kernel.org/stable/c/166221c52d3ca332f8699a854efca8e2704bb137"}, {"url": "https://git.kernel.org/stable/c/08b534bafdd9de65b6374474a8fe719c90eb3b01"}, {"url": "https://git.kernel.org/stable/c/66ff2eff093d2a0838f39c713eeb590bc0946c2a"}, {"url": "https://git.kernel.org/stable/c/b90c5d770dad910fb89e6c1b15052a8a1e8db752"}], "title": "bpf: Preserve inner map identity in callback frames", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/bpf/verifier.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "cf85e4f94d7feef8b3c4c90dbe2468595a48393b", "status": "affected", "version": "69c087ba6225b574afb6e505b72cb75242a3d844", "versionType": "git"}, {"lessThan": "166221c52d3ca332f8699a854efca8e2704bb137", "status": "affected", "version": "69c087ba6225b574afb6e505b72cb75242a3d844", "versionType": "git"}, {"lessThan": "08b534bafdd9de65b6374474a8fe719c90eb3b01", "status": "affected", "version": "69c087ba6225b574afb6e505b72cb75242a3d844", "versionType": "git"}, {"lessThan": "66ff2eff093d2a0838f39c713eeb590bc0946c2a", "status": "affected", "version": "69c087ba6225b574afb6e505b72cb75242a3d844", "versionType": "git"}, {"lessThan": "b90c5d770dad910fb89e6c1b15052a8a1e8db752", "status": "affected", "version": "69c087ba6225b574afb6e505b72cb75242a3d844", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/bpf/verifier.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.13"}, {"lessThan": "5.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Preserve inner map identity in callback frames\n\nCallback frame constructors initialize map-typed argument registers with\n__mark_reg_known_zero() and then restore map_ptr. This clears map_uid,\nwhich is the only field distinguishing inner maps that share an\ninner_map_meta template.\n\nWhen a timer callback invokes bpf_for_each_map_elem() on a second inner\nmap, both the saved first map and the second map value can reach the nested\ncallback as the same template with map_uid zero. bpf_timer_init() then\naccepts pairing the timer from the second map with the first map.\n\nThe runtime records the first map in the timer without taking a reference.\nFreeing that map does not find the timer stored in the second map, so a\nlater timer callback dereferences the freed map.\n\nCopy map_uid from the same caller register as map_ptr when constructing\nfor-each, timer/workqueue, and task-work callback arguments. The existing\nidentity check can then reject mismatched inner maps while allowing a\ncallback value to be paired with its actual map."}], "id": "CVE-2026-98033", "lastModified": "2026-10-21T13:21:19.500", "metrics": {}, "published": "2026-09-25T11:17:32.003", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/08b534bafdd9de65b6374474a8fe719c90eb3b01"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/166221c52d3ca332f8699a854efca8e2704bb137"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/66ff2eff093d2a0838f39c713eeb590bc0946c2a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b90c5d770dad910fb89e6c1b15052a8a1e8db752"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cf85e4f94d7feef8b3c4c90dbe2468595a48393b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: bpf: Preserve inner map identity in callback frames", "id": "2541194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541194"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: Preserve inner map identity in callback frames\nCallback frame constructors initialize map-typed argument registers with\n__mark_reg_known_zero() and then restore map_ptr. This clears map_uid,\nwhich is the only field distinguishing inner maps that share an\ninner_map_meta template.\nWhen a timer callback invokes bpf_for_each_map_elem() on a second inner\nmap, both the saved first map and the second map value can reach the nested\ncallback as the same template with map_uid zero. bpf_timer_init() then\naccepts pairing the timer from the second map with the first map.\nThe runtime records the first map in the timer without taking a reference.\nFreeing that map does not find the timer stored in the second map, so a\nlater timer callback dereferences the freed map.\nCopy map_uid from the same caller register as map_ptr when constructing\nfor-each, timer/workqueue, and task-work callback arguments. The existing\nidentity check can then reject mismatched inner maps while allowing a\ncallback value to be paired with its actual map.", "A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. The kernel's program verifier improperly resets tracking identifiers when preparing callback functions, causing it to confuse different internal data structures sharing the same template. A local user with permission to load BPF programs could exploit this flaw to cause the kernel to access memory after it has been freed. This use-after-free condition can result in privilege escalation or a Denial of Service (DoS) by crashing the system."], "name": "CVE-2026-98033", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98033\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98033\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98033.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[69c087ba6225b574afb6e505b72cb75242a3d844,66ff2eff093d2a0838f39c713eeb590bc0946c2a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[69c087ba6225b574afb6e505b72cb75242a3d844,b90c5d770dad910fb89e6c1b15052a8a1e8db752)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T15:15:14.510305+00:00", "updated": "2026-09-30T14:30:18.587179+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}