CVE-2026-98800

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98800", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.370Z", "datePublished": "2026-10-18T15:48:46.223Z", "dateUpdated": "2026-10-19T09:25:53.724Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:25:53.724Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Wait for an RCU tasks grace period before freeing trampoline progs\n\nWhen a prog is detached from a trampoline, it is freed after an RCU\ngrace period, or an RCU tasks trace one if it is sleepable. This covers\nthe tasks that are running the prog, since the prog's enter helper takes\nthe matching read lock before the prog is called. On a preemptible\nkernel, it doesn't cover a task that was preempted in the trampoline\njust before the enter helper. That task holds no lock yet, and it calls\nthe prog after it was freed:\n\n BUG: KASAN: vmalloc-out-of-bounds in __bpf_prog_enter_recur+0x3a5/0x3f0\n Read of size 8 at addr ffffc90000055040 by task candidate/110\n CPU: 1 UID: 0 PID: 110 Comm: candidate Not tainted 7.3.0-rc2-00014-g15071f2a1263-dirty #2 PREEMPT(full)\n Call Trace:\n <TASK>\n __bpf_prog_enter_recur+0x3a5/0x3f0\n bpf_trampoline_6442509193+0x37/0xf1\n __x64_sys_futex+0x9/0x410\n do_syscall_64+0xb0/0x530\n ...\n\nWait for an RCU tasks grace period before the existing one when freeing\na prog that was linked to a trampoline. An RCU tasks grace period only\nends once the tasks that were preempted have run again, and\nbpf_tramp_image_put() already relies on it to free the image. It doesn't\nwait for tasks that sleep in the trampoline, the next commit takes care\nof those.\n\nOnly progs that were linked to a trampoline can be called this way, so\nbpf_trampoline_add_prog() marks them and other progs are still freed as\nbefore."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/bpf.h", "kernel/bpf/syscall.c", "kernel/bpf/trampoline.c"], "versions": [{"version": "e21aa341785c679dd409c8cb71f864c00fe6c463", "lessThan": "40955f6512a03f0e046f5256b0706b26ba191018", "status": "affected", "versionType": "git"}, {"version": "e21aa341785c679dd409c8cb71f864c00fe6c463", "lessThan": "0fb5751a6e411b1b466c06e50021818d9391df98", "status": "affected", "versionType": "git"}, {"version": "e21d2b92354b3cd25dd774ebb0f0e52ff04a7861", "status": "affected", "versionType": "git"}, {"version": "85d177f56e5256e14b74a65940f981f6e3e8bb32", "status": "affected", "versionType": "git"}, {"version": "5.10.28", "lessThan": "5.11", "status": "affected", "versionType": "semver"}, {"version": "5.11.11", "lessThan": "5.12", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/bpf.h", "kernel/bpf/syscall.c", "kernel/bpf/trampoline.c"], "versions": [{"version": "5.12", "status": "affected"}, {"version": "0", "lessThan": "5.12", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.28"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11.11"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/40955f6512a03f0e046f5256b0706b26ba191018"}, {"url": "https://git.kernel.org/stable/c/0fb5751a6e411b1b466c06e50021818d9391df98"}], "title": "bpf: Wait for an RCU tasks grace period before freeing trampoline progs", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/linux/bpf.h", "kernel/bpf/syscall.c", "kernel/bpf/trampoline.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "40955f6512a03f0e046f5256b0706b26ba191018", "status": "affected", "version": "e21aa341785c679dd409c8cb71f864c00fe6c463", "versionType": "git"}, {"lessThan": "0fb5751a6e411b1b466c06e50021818d9391df98", "status": "affected", "version": "e21aa341785c679dd409c8cb71f864c00fe6c463", "versionType": "git"}, {"status": "affected", "version": "e21d2b92354b3cd25dd774ebb0f0e52ff04a7861", "versionType": "git"}, {"status": "affected", "version": "85d177f56e5256e14b74a65940f981f6e3e8bb32", "versionType": "git"}, {"lessThan": "5.11", "status": "affected", "version": "5.10.28", "versionType": "semver"}, {"lessThan": "5.12", "status": "affected", "version": "5.11.11", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/linux/bpf.h", "kernel/bpf/syscall.c", "kernel/bpf/trampoline.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.12"}, {"lessThan": "5.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Wait for an RCU tasks grace period before freeing trampoline progs\n\nWhen a prog is detached from a trampoline, it is freed after an RCU\ngrace period, or an RCU tasks trace one if it is sleepable. This covers\nthe tasks that are running the prog, since the prog's enter helper takes\nthe matching read lock before the prog is called. On a preemptible\nkernel, it doesn't cover a task that was preempted in the trampoline\njust before the enter helper. That task holds no lock yet, and it calls\nthe prog after it was freed:\n\n BUG: KASAN: vmalloc-out-of-bounds in __bpf_prog_enter_recur+0x3a5/0x3f0\n Read of size 8 at addr ffffc90000055040 by task candidate/110\n CPU: 1 UID: 0 PID: 110 Comm: candidate Not tainted 7.3.0-rc2-00014-g15071f2a1263-dirty #2 PREEMPT(full)\n Call Trace:\n <TASK>\n __bpf_prog_enter_recur+0x3a5/0x3f0\n bpf_trampoline_6442509193+0x37/0xf1\n __x64_sys_futex+0x9/0x410\n do_syscall_64+0xb0/0x530\n ...\n\nWait for an RCU tasks grace period before the existing one when freeing\na prog that was linked to a trampoline. An RCU tasks grace period only\nends once the tasks that were preempted have run again, and\nbpf_tramp_image_put() already relies on it to free the image. It doesn't\nwait for tasks that sleep in the trampoline, the next commit takes care\nof those.\n\nOnly progs that were linked to a trampoline can be called this way, so\nbpf_trampoline_add_prog() marks them and other progs are still freed as\nbefore."}], "id": "CVE-2026-98800", "lastModified": "2026-10-19T10:19:44.050", "metrics": {}, "published": "2026-10-18T16:17:34.030", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0fb5751a6e411b1b466c06e50021818d9391df98"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/40955f6512a03f0e046f5256b0706b26ba191018"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via use-after-free in BPF trampoline", "id": "2555072", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555072"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: Wait for an RCU tasks grace period before freeing trampoline progs\nWhen a prog is detached from a trampoline, it is freed after an RCU\ngrace period, or an RCU tasks trace one if it is sleepable. This covers\nthe tasks that are running the prog, since the prog's enter helper takes\nthe matching read lock before the prog is called. On a preemptible\nkernel, it doesn't cover a task that was preempted in the trampoline\njust before the enter helper. That task holds no lock yet, and it calls\nthe prog after it was freed:\nBUG: KASAN: vmalloc-out-of-bounds in __bpf_prog_enter_recur+0x3a5/0x3f0\nRead of size 8 at addr ffffc90000055040 by task candidate/110\nCPU: 1 UID: 0 PID: 110 Comm: candidate Not tainted 7.3.0-rc2-00014-g15071f2a1263-dirty #2 PREEMPT(full)\nCall Trace:\n<TASK>\n__bpf_prog_enter_recur+0x3a5/0x3f0\nbpf_trampoline_6442509193+0x37/0xf1\n__x64_sys_futex+0x9/0x410\ndo_syscall_64+0xb0/0x530\n...\nWait for an RCU tasks grace period before the existing one when freeing\na prog that was linked to a trampoline. An RCU tasks grace period only\nends once the tasks that were preempted have run again, and\nbpf_tramp_image_put() already relies on it to free the image. It doesn't\nwait for tasks that sleep in the trampoline, the next commit takes care\nof those.\nOnly progs that were linked to a trampoline can be called this way, so\nbpf_trampoline_add_prog() marks them and other progs are still freed as\nbefore.", "A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. When a BPF program attached to a trampoline is detached, the kernel may release the program's memory prematurely before preempted tasks have safely completed execution. A local user can exploit this race condition to access freed memory, resulting in a kernel crash and Denial of Service (DoS) or potential memory corruption."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-98800", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-10-18T15:48:46Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98800\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98800\nhttps://git.kernel.org/stable/c/0fb5751a6e411b1b466c06e50021818d9391df98\nhttps://git.kernel.org/stable/c/40955f6512a03f0e046f5256b0706b26ba191018\nhttps://kernelcve.org/list/?q=CVE-2026-98800"], "statement": "A race in BPF trampoline program teardown can free a program while a task preempted inside the trampoline is still able to call it. The task may be interrupted before the program enter helper acquires its RCU read lock, so the previous RCU synchronization does not protect this execution path. When the task resumes it can execute or access the freed BPF program, producing a confirmed use-after-free symptom reported by KASAN as a vmalloc-out-of-bounds read. Impact is at least a local denial of service via kernel crash. Because the freed object is a trampoline linked BPF program and may be reused before the preempted task resumes, the worst case may include confidentiality and integrity impact or privilege escalation and should be reviewed manually. For the CVSS the PR:L in the paranoid score represents environments where BPF tracing capabilities are delegated to a restricted service account, container root, or local BPF operator without full host administration. AC:H applies because successful triggering depends on a preemption race window. The issue is local and is not directly network reachable.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e21aa341785c679dd409c8cb71f864c00fe6c463,40955f6512a03f0e046f5256b0706b26ba191018)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e21aa341785c679dd409c8cb71f864c00fe6c463,0fb5751a6e411b1b466c06e50021818d9391df98)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "e21d2b92354b3cd25dd774ebb0f0e52ff04a7861"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "85d177f56e5256e14b74a65940f981f6e3e8bb32"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.10.28,5.11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.11.11,5.12)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T21:45:05.269199+00:00", "updated": "2026-10-23T06:30:07.424234+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}