CVE-2026-98642

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98642", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.361Z", "datePublished": "2026-10-18T15:20:13.740Z", "dateUpdated": "2026-10-19T09:23:11.995Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:23:11.995Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk\n\nSyzkaller repeatedly triggered UAF splats related to nodes in\nwaiting_for_gp_ttrace within the bpf memalloc:\n\nBUG: KASAN: slab-use-after-free in llist_del_first+0x85/0x110 lib/llist.c:61\nRead of size 8 at addr ffff8881572cd080 by task syz.4.470/5112\n ...\n llist_del_first+0x85/0x110 lib/llist.c:61\n alloc_bulk+0x193/0x460 kernel/bpf/memalloc.c:229\n bpf_mem_refill+0x386/0x560 kernel/bpf/memalloc.c:436\n\nFreed by task 14:\n ...\n __free_rcu kernel/bpf/memalloc.c:281 [inline]\n __free_rcu_tasks_trace+0x48/0xd0 kernel/bpf/memalloc.c:291\n rcu_tasks_invoke_cbs+0x1ec/0x3e0 kernel/rcu/tasks.h:571\n rcu_tasks_one_gp+0x13d/0x220 kernel/rcu/tasks.h:621\n rcu_tasks_kthread+0xf3/0x120 kernel/rcu/tasks.h:651\n\nThe reason is that the UAF occurs after the RCU Tasks Trace GP expires:\nwhen the __free_rcu() callback runs, there is no synchronization\nprotecting llist_del_all() against concurrent alloc_bulk() operating on\nwaiting_for_gp_ttrace, leading to the race condition below:\n\nCPU0 CPU1\n __free_rcu (RCU Tasks Trace callback)\nalloc_bulk\n llist_del_first(&c->waiting_for_gp_ttrace)\n entry = smp_load_acquire(&head->first);\n do {\n if (entry == NULL)\n return NULL;\n free_all(llist_del_all(&c->waiting_for_gp_ttrace))\n llist_for_each_safe(pos, t, llnode)\n free_one(pos);\n next = READ_ONCE(entry->next); <-- trigger UAF\n } while (!try_cmpxchg(&head->first, &entry, next));\n\nIn addition, there is also a theoretical race condition on the\nfree_by_rcu_ttrace list. This race requires two preconditions: an\nin-flight Tasks Trace GP keeping c->call_rcu_ttrace_in_progress == 1,\nand concurrent cross-CPU frees repopulating c->free_by_rcu_ttrace with\nnew nodes. Under these conditions, the following scenario triggers UAF:\n\n// CPU0\n// irq work is still busy (on PREEMPT_RT)\nalloc_bulk()\n llist_del_first(&c->free_by_rcu_ttrace)\n entry = smp_load_acquire(&head->first);\n do {\n if (entry == NULL)\n return NULL;\n\n // CPU1\n bpf_mem_alloc_destroy()\n WRITE_ONCE(c->draining, true)\n // wait for CPU0\n irq_work_sync()\n\n // CPU2\n do_call_rcu_ttrace(tgt(CPU0))\n if (c->draining) {\n llist_del_all(&c->free_by_rcu_ttrace)\n free_all()\n }\n\n// CPU0 continue\n next = READ_ONCE(entry->next); <-- trigger UAF\n while (!try_cmpxchg(&head->first, &entry, next));\n\nFix this by introducing a raw spinlock to synchronize the concurrent\nconsumption on waiting_for_gp_ttrace and free_by_rcu_ttrace."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/memalloc.c"], "versions": [{"version": "04fabf00b4d3aff5d010ecb617001814e409e24a", "lessThan": "a0e150a118025a05c8662c536ba2a865da86419c", "status": "affected", "versionType": "git"}, {"version": "04fabf00b4d3aff5d010ecb617001814e409e24a", "lessThan": "1d6581b544a88cf4348c2fb60dcb50ad63f012da", "status": "affected", "versionType": "git"}, {"version": "04fabf00b4d3aff5d010ecb617001814e409e24a", "lessThan": "f101602415fb39a58941bec444df65634d5a6844", "status": "affected", "versionType": "git"}, {"version": "04fabf00b4d3aff5d010ecb617001814e409e24a", "lessThan": "1c21452d02eec2f008e2c5535820f85adbd7587a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/memalloc.c"], "versions": [{"version": "6.6", "status": "affected"}, {"version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a0e150a118025a05c8662c536ba2a865da86419c"}, {"url": "https://git.kernel.org/stable/c/1d6581b544a88cf4348c2fb60dcb50ad63f012da"}, {"url": "https://git.kernel.org/stable/c/f101602415fb39a58941bec444df65634d5a6844"}, {"url": "https://git.kernel.org/stable/c/1c21452d02eec2f008e2c5535820f85adbd7587a"}], "title": "bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/bpf/memalloc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a0e150a118025a05c8662c536ba2a865da86419c", "status": "affected", "version": "04fabf00b4d3aff5d010ecb617001814e409e24a", "versionType": "git"}, {"lessThan": "1d6581b544a88cf4348c2fb60dcb50ad63f012da", "status": "affected", "version": "04fabf00b4d3aff5d010ecb617001814e409e24a", "versionType": "git"}, {"lessThan": "f101602415fb39a58941bec444df65634d5a6844", "status": "affected", "version": "04fabf00b4d3aff5d010ecb617001814e409e24a", "versionType": "git"}, {"lessThan": "1c21452d02eec2f008e2c5535820f85adbd7587a", "status": "affected", "version": "04fabf00b4d3aff5d010ecb617001814e409e24a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/bpf/memalloc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"lessThan": "6.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk\n\nSyzkaller repeatedly triggered UAF splats related to nodes in\nwaiting_for_gp_ttrace within the bpf memalloc:\n\nBUG: KASAN: slab-use-after-free in llist_del_first+0x85/0x110 lib/llist.c:61\nRead of size 8 at addr ffff8881572cd080 by task syz.4.470/5112\n ...\n llist_del_first+0x85/0x110 lib/llist.c:61\n alloc_bulk+0x193/0x460 kernel/bpf/memalloc.c:229\n bpf_mem_refill+0x386/0x560 kernel/bpf/memalloc.c:436\n\nFreed by task 14:\n ...\n __free_rcu kernel/bpf/memalloc.c:281 [inline]\n __free_rcu_tasks_trace+0x48/0xd0 kernel/bpf/memalloc.c:291\n rcu_tasks_invoke_cbs+0x1ec/0x3e0 kernel/rcu/tasks.h:571\n rcu_tasks_one_gp+0x13d/0x220 kernel/rcu/tasks.h:621\n rcu_tasks_kthread+0xf3/0x120 kernel/rcu/tasks.h:651\n\nThe reason is that the UAF occurs after the RCU Tasks Trace GP expires:\nwhen the __free_rcu() callback runs, there is no synchronization\nprotecting llist_del_all() against concurrent alloc_bulk() operating on\nwaiting_for_gp_ttrace, leading to the race condition below:\n\nCPU0 CPU1\n __free_rcu (RCU Tasks Trace callback)\nalloc_bulk\n llist_del_first(&c->waiting_for_gp_ttrace)\n entry = smp_load_acquire(&head->first);\n do {\n if (entry == NULL)\n return NULL;\n free_all(llist_del_all(&c->waiting_for_gp_ttrace))\n llist_for_each_safe(pos, t, llnode)\n free_one(pos);\n next = READ_ONCE(entry->next); <-- trigger UAF\n } while (!try_cmpxchg(&head->first, &entry, next));\n\nIn addition, there is also a theoretical race condition on the\nfree_by_rcu_ttrace list. This race requires two preconditions: an\nin-flight Tasks Trace GP keeping c->call_rcu_ttrace_in_progress == 1,\nand concurrent cross-CPU frees repopulating c->free_by_rcu_ttrace with\nnew nodes. Under these conditions, the following scenario triggers UAF:\n\n// CPU0\n// irq work is still busy (on PREEMPT_RT)\nalloc_bulk()\n llist_del_first(&c->free_by_rcu_ttrace)\n entry = smp_load_acquire(&head->first);\n do {\n if (entry == NULL)\n return NULL;\n\n // CPU1\n bpf_mem_alloc_destroy()\n WRITE_ONCE(c->draining, true)\n // wait for CPU0\n irq_work_sync()\n\n // CPU2\n do_call_rcu_ttrace(tgt(CPU0))\n if (c->draining) {\n llist_del_all(&c->free_by_rcu_ttrace)\n free_all()\n }\n\n// CPU0 continue\n next = READ_ONCE(entry->next); <-- trigger UAF\n while (!try_cmpxchg(&head->first, &entry, next));\n\nFix this by introducing a raw spinlock to synchronize the concurrent\nconsumption on waiting_for_gp_ttrace and free_by_rcu_ttrace."}], "id": "CVE-2026-98642", "lastModified": "2026-10-19T10:19:28.443", "metrics": {}, "published": "2026-10-18T16:17:17.367", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1c21452d02eec2f008e2c5535820f85adbd7587a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1d6581b544a88cf4348c2fb60dcb50ad63f012da"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a0e150a118025a05c8662c536ba2a865da86419c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f101602415fb39a58941bec444df65634d5a6844"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via race condition in BPF memory allocator", "id": "2555007", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555007"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk\nSyzkaller repeatedly triggered UAF splats related to nodes in\nwaiting_for_gp_ttrace within the bpf memalloc:\nBUG: KASAN: slab-use-after-free in llist_del_first+0x85/0x110 lib/llist.c:61\nRead of size 8 at addr ffff8881572cd080 by task syz.4.470/5112\n...\nllist_del_first+0x85/0x110 lib/llist.c:61\nalloc_bulk+0x193/0x460 kernel/bpf/memalloc.c:229\nbpf_mem_refill+0x386/0x560 kernel/bpf/memalloc.c:436\nFreed by task 14:\n...\n__free_rcu kernel/bpf/memalloc.c:281 [inline]\n__free_rcu_tasks_trace+0x48/0xd0 kernel/bpf/memalloc.c:291\nrcu_tasks_invoke_cbs+0x1ec/0x3e0 kernel/rcu/tasks.h:571\nrcu_tasks_one_gp+0x13d/0x220 kernel/rcu/tasks.h:621\nrcu_tasks_kthread+0xf3/0x120 kernel/rcu/tasks.h:651\nThe reason is that the UAF occurs after the RCU Tasks Trace GP expires:\nwhen the __free_rcu() callback runs, there is no synchronization\nprotecting llist_del_all() against concurrent alloc_bulk() operating on\nwaiting_for_gp_ttrace, leading to the race condition below:\nCPU0 CPU1\n__free_rcu (RCU Tasks Trace callback)\nalloc_bulk\nllist_del_first(&c->waiting_for_gp_ttrace)\nentry = smp_load_acquire(&head->first);\ndo {\nif (entry == NULL)\nreturn NULL;\nfree_all(llist_del_all(&c->waiting_for_gp_ttrace))\nllist_for_each_safe(pos, t, llnode)\nfree_one(pos);\nnext = READ_ONCE(entry->next); <-- trigger UAF\n} while (!try_cmpxchg(&head->first, &entry, next));\nIn addition, there is also a theoretical race condition on the\nfree_by_rcu_ttrace list. This race requires two preconditions: an\nin-flight Tasks Trace GP keeping c->call_rcu_ttrace_in_progress == 1,\nand concurrent cross-CPU frees repopulating c->free_by_rcu_ttrace with\nnew nodes. Under these conditions, the following scenario triggers UAF:\n// CPU0\n// irq work is still busy (on PREEMPT_RT)\nalloc_bulk()\nllist_del_first(&c->free_by_rcu_ttrace)\nentry = smp_load_acquire(&head->first);\ndo {\nif (entry == NULL)\nreturn NULL;\n// CPU1\nbpf_mem_alloc_destroy()\nWRITE_ONCE(c->draining, true)\n// wait for CPU0\nirq_work_sync()\n// CPU2\ndo_call_rcu_ttrace(tgt(CPU0))\nif (c->draining) {\nllist_del_all(&c->free_by_rcu_ttrace)\nfree_all()\n}\n// CPU0 continue\nnext = READ_ONCE(entry->next); <-- trigger UAF\nwhile (!try_cmpxchg(&head->first, &entry, next));\nFix this by introducing a raw spinlock to synchronize the concurrent\nconsumption on waiting_for_gp_ttrace and free_by_rcu_ttrace.", "A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) memory allocator. A race condition occurs when bulk memory allocation and memory cleanup run concurrently without adequate synchronization. A local attacker could exploit this flaw to trigger a use-after-free condition, leading to a Denial of Service (DoS) via a system crash or potential privilege escalation."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-98642", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-10-18T15:20:13Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98642\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98642\nhttps://git.kernel.org/stable/c/1c21452d02eec2f008e2c5535820f85adbd7587a\nhttps://git.kernel.org/stable/c/1d6581b544a88cf4348c2fb60dcb50ad63f012da\nhttps://git.kernel.org/stable/c/a0e150a118025a05c8662c536ba2a865da86419c\nhttps://git.kernel.org/stable/c/f101602415fb39a58941bec444df65634d5a6844\nhttps://kernelcve.org/list/?q=CVE-2026-98642"], "statement": "A race in the BPF memory allocator allows alloc_bulk to consume waiting_for_gp_ttrace while an RCU Tasks Trace callback removes and frees the same list. The confirmed result is a use-after-free read of entry next in llist_del_first, which can cause a kernel crash and may propagate stale list state if the freed node is reused before the read. A related race can affect free_by_rcu_ttrace during allocator draining when IRQ work and cross-CPU frees overlap. For the CVSS the PR:L value is used because a local user or process with access to the BPF interface may create the required allocation and free activity. Systems that disable unprivileged BPF may require CAP_BPF or equivalent capabilities and therefore have lower practical exposure. AC:H is used because successful triggering depends on a concurrent timing window involving RCU callbacks and list consumption. The issue is not directly network reachable. Impact is at least a local denial of service via kernel crash and in the paranoid case may include confidentiality and integrity impact due to reuse of a freed list node and possible allocator state corruption. Privilege escalation is plausible as a worst-case consequence of the memory corruption class but is not demonstrated by the available evidence.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[04fabf00b4d3aff5d010ecb617001814e409e24a,a0e150a118025a05c8662c536ba2a865da86419c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[04fabf00b4d3aff5d010ecb617001814e409e24a,1c21452d02eec2f008e2c5535820f85adbd7587a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[04fabf00b4d3aff5d010ecb617001814e409e24a,1d6581b544a88cf4348c2fb60dcb50ad63f012da)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[04fabf00b4d3aff5d010ecb617001814e409e24a,f101602415fb39a58941bec444df65634d5a6844)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.6,6.6]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T19:15:14.233930+00:00", "updated": "2026-10-23T06:45:07.465406+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}