CVE-2026-98813

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98813", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.371Z", "datePublished": "2026-10-18T15:48:59.745Z", "dateUpdated": "2026-10-19T09:26:06.490Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:26:06.490Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Hold map BTF for the memory allocator destructor record\n\nbpf_ma_set_dtor() duplicates map->record so that the bpf_mem_alloc\ndestructor can release the special fields of hash and rhash map elements\nonce the allocator frees them for good. btf_record_dup() only acquires\nreferences on kernel and module BTF. Fields whose types live in the map\nBTF keep pointing into it: a kptr to a local type refers to map->btf,\nand a list_head or rb_root field carries a value_rec owned by the struct\nmeta table of map->btf.\n\nThat borrowed state can outlive the map. When RCU callbacks are still in\nflight, bpf_mem_alloc_destroy() copies the allocator and defers the final\ndrain, together with the destructor context, to a workqueue.\nbpf_map_free() then frees map->record and drops the map's BTF reference\nas soon as map_free() returns. Once the program that loaded the BTF is\ngone as well, the BTF is freed while the worker still uses the\nduplicate. The worker dereferences it through btf_is_kernel() and\nbtf_find_struct_meta() in bpf_obj_free_fields() when destroying elements\nthat were freed under RCU, and through btf_is_kernel() in\nbtf_record_free() when releasing the context itself:\n\n BUG: KASAN: slab-use-after-free in btf_is_kernel+0x19/0x30\n Read of size 1 at addr ffff88811505dce8 by task kworker/u16:2/50\n Workqueue: events_unbound free_mem_alloc_deferred\n Call Trace:\n btf_is_kernel+0x19/0x30\n btf_record_free+0xc7/0xf0\n htab_dtor_ctx_free+0x1a/0x30\n free_mem_alloc_no_barrier+0x39/0x230\n free_mem_alloc_deferred+0x2a/0x40\n process_scheduled_works+0x5ce/0x9d0\n worker_thread+0x42a/0x5e0\n kthread+0x1f5/0x230\n ret_from_fork+0x1dd/0x390\n ret_from_fork_asm+0x1a/0x30\n\n Allocated by task 358:\n __kmalloc_cache_noprof+0x287/0x510\n btf_new_fd+0xf7/0x3d0\n __sys_bpf+0x487/0x840\n\n Freed by task 0:\n kfree+0x186/0x560\n rcu_core+0x6f6/0xd40\n\nFreeing a map that still holds more elements than the allocator's high\nwatermark is enough to get there, because the bulk free during teardown\nqueues the RCU callback that makes bpf_mem_alloc_destroy() defer.\nNon-preallocated hash maps and resizable hash maps both register the\ndestructor and are affected alike.\n\nKeep one reference on the map BTF in the destructor context. Every\nnon-kernel pointer in the duplicated record is either map->btf or memory\nowned by it, so a single reference covers kptrs, list heads, and rb\nroots, and mirrors what bpf_map_meta_alloc() does for the duplicated\nrecord of an inner map. Release it only after the duplicated record has\nbeen freed: the worker is preemptible and not in an RCU read-side\ncritical section, so dropping the last reference first would let the\nBTF be freed while btf_record_free() still reads its fields."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/hashtab.c"], "versions": [{"version": "1df97a7453eec80c1912c2d0360290a3970a7671", "lessThan": "b506f5699e145196ee29d76cf1ca1cbb2202c055", "status": "affected", "versionType": "git"}, {"version": "1df97a7453eec80c1912c2d0360290a3970a7671", "lessThan": "ab39974240a0cff765f3bb9cce81d8001ffdb144", "status": "affected", "versionType": "git"}, {"version": "451a84a3ad3c897c03181af433e7c98640730f1f", "status": "affected", "versionType": "git"}, {"version": "51a17f0ce19c4ee2a25cf16c93490d509b1ebb0a", "status": "affected", "versionType": "git"}, {"version": "6.12.112", "lessThan": "6.13", "status": "affected", "versionType": "semver"}, {"version": "6.18.55", "lessThan": "6.19", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/hashtab.c"], "versions": [{"version": "7.0", "status": "affected"}, {"version": "0", "lessThan": "7.0", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.55"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b506f5699e145196ee29d76cf1ca1cbb2202c055"}, {"url": "https://git.kernel.org/stable/c/ab39974240a0cff765f3bb9cce81d8001ffdb144"}], "title": "bpf: Hold map BTF for the memory allocator destructor record", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/bpf/hashtab.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b506f5699e145196ee29d76cf1ca1cbb2202c055", "status": "affected", "version": "1df97a7453eec80c1912c2d0360290a3970a7671", "versionType": "git"}, {"lessThan": "ab39974240a0cff765f3bb9cce81d8001ffdb144", "status": "affected", "version": "1df97a7453eec80c1912c2d0360290a3970a7671", "versionType": "git"}, {"status": "affected", "version": "451a84a3ad3c897c03181af433e7c98640730f1f", "versionType": "git"}, {"status": "affected", "version": "51a17f0ce19c4ee2a25cf16c93490d509b1ebb0a", "versionType": "git"}, {"lessThan": "6.13", "status": "affected", "version": "6.12.112", "versionType": "semver"}, {"lessThan": "6.19", "status": "affected", "version": "6.18.55", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/bpf/hashtab.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.0"}, {"lessThan": "7.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Hold map BTF for the memory allocator destructor record\n\nbpf_ma_set_dtor() duplicates map->record so that the bpf_mem_alloc\ndestructor can release the special fields of hash and rhash map elements\nonce the allocator frees them for good. btf_record_dup() only acquires\nreferences on kernel and module BTF. Fields whose types live in the map\nBTF keep pointing into it: a kptr to a local type refers to map->btf,\nand a list_head or rb_root field carries a value_rec owned by the struct\nmeta table of map->btf.\n\nThat borrowed state can outlive the map. When RCU callbacks are still in\nflight, bpf_mem_alloc_destroy() copies the allocator and defers the final\ndrain, together with the destructor context, to a workqueue.\nbpf_map_free() then frees map->record and drops the map's BTF reference\nas soon as map_free() returns. Once the program that loaded the BTF is\ngone as well, the BTF is freed while the worker still uses the\nduplicate. The worker dereferences it through btf_is_kernel() and\nbtf_find_struct_meta() in bpf_obj_free_fields() when destroying elements\nthat were freed under RCU, and through btf_is_kernel() in\nbtf_record_free() when releasing the context itself:\n\n BUG: KASAN: slab-use-after-free in btf_is_kernel+0x19/0x30\n Read of size 1 at addr ffff88811505dce8 by task kworker/u16:2/50\n Workqueue: events_unbound free_mem_alloc_deferred\n Call Trace:\n btf_is_kernel+0x19/0x30\n btf_record_free+0xc7/0xf0\n htab_dtor_ctx_free+0x1a/0x30\n free_mem_alloc_no_barrier+0x39/0x230\n free_mem_alloc_deferred+0x2a/0x40\n process_scheduled_works+0x5ce/0x9d0\n worker_thread+0x42a/0x5e0\n kthread+0x1f5/0x230\n ret_from_fork+0x1dd/0x390\n ret_from_fork_asm+0x1a/0x30\n\n Allocated by task 358:\n __kmalloc_cache_noprof+0x287/0x510\n btf_new_fd+0xf7/0x3d0\n __sys_bpf+0x487/0x840\n\n Freed by task 0:\n kfree+0x186/0x560\n rcu_core+0x6f6/0xd40\n\nFreeing a map that still holds more elements than the allocator's high\nwatermark is enough to get there, because the bulk free during teardown\nqueues the RCU callback that makes bpf_mem_alloc_destroy() defer.\nNon-preallocated hash maps and resizable hash maps both register the\ndestructor and are affected alike.\n\nKeep one reference on the map BTF in the destructor context. Every\nnon-kernel pointer in the duplicated record is either map->btf or memory\nowned by it, so a single reference covers kptrs, list heads, and rb\nroots, and mirrors what bpf_map_meta_alloc() does for the duplicated\nrecord of an inner map. Release it only after the duplicated record has\nbeen freed: the worker is preemptible and not in an RCU read-side\ncritical section, so dropping the last reference first would let the\nBTF be freed while btf_record_free() still reads its fields."}], "id": "CVE-2026-98813", "lastModified": "2026-10-19T10:19:45.330", "metrics": {}, "published": "2026-10-18T16:17:35.427", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ab39974240a0cff765f3bb9cce81d8001ffdb144"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b506f5699e145196ee29d76cf1ca1cbb2202c055"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: bpf: Hold map BTF for the memory allocator destructor record", "id": "2555234", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555234"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: Hold map BTF for the memory allocator destructor record\nbpf_ma_set_dtor() duplicates map->record so that the bpf_mem_alloc\ndestructor can release the special fields of hash and rhash map elements\nonce the allocator frees them for good. btf_record_dup() only acquires\nreferences on kernel and module BTF. Fields whose types live in the map\nBTF keep pointing into it: a kptr to a local type refers to map->btf,\nand a list_head or rb_root field carries a value_rec owned by the struct\nmeta table of map->btf.\nThat borrowed state can outlive the map. When RCU callbacks are still in\nflight, bpf_mem_alloc_destroy() copies the allocator and defers the final\ndrain, together with the destructor context, to a workqueue.\nbpf_map_free() then frees map->record and drops the map's BTF reference\nas soon as map_free() returns. Once the program that loaded the BTF is\ngone as well, the BTF is freed while the worker still uses the\nduplicate. The worker dereferences it through btf_is_kernel() and\nbtf_find_struct_meta() in bpf_obj_free_fields() when destroying elements\nthat were freed under RCU, and through btf_is_kernel() in\nbtf_record_free() when releasing the context itself:\nBUG: KASAN: slab-use-after-free in btf_is_kernel+0x19/0x30\nRead of size 1 at addr ffff88811505dce8 by task kworker/u16:2/50\nWorkqueue: events_unbound free_mem_alloc_deferred\nCall Trace:\nbtf_is_kernel+0x19/0x30\nbtf_record_free+0xc7/0xf0\nhtab_dtor_ctx_free+0x1a/0x30\nfree_mem_alloc_no_barrier+0x39/0x230\nfree_mem_alloc_deferred+0x2a/0x40\nprocess_scheduled_works+0x5ce/0x9d0\nworker_thread+0x42a/0x5e0\nkthread+0x1f5/0x230\nret_from_fork+0x1dd/0x390\nret_from_fork_asm+0x1a/0x30\nAllocated by task 358:\n__kmalloc_cache_noprof+0x287/0x510\nbtf_new_fd+0xf7/0x3d0\n__sys_bpf+0x487/0x840\nFreed by task 0:\nkfree+0x186/0x560\nrcu_core+0x6f6/0xd40\nFreeing a map that still holds more elements than the allocator's high\nwatermark is enough to get there, because the bulk free during teardown\nqueues the RCU callback that makes bpf_mem_alloc_destroy() defer.\nNon-preallocated hash maps and resizable hash maps both register the\ndestructor and are affected alike.\nKeep one reference on the map BTF in the destructor context. Every\nnon-kernel pointer in the duplicated record is either map->btf or memory\nowned by it, so a single reference covers kptrs, list heads, and rb\nroots, and mirrors what bpf_map_meta_alloc() does for the duplicated\nrecord of an inner map. Release it only after the duplicated record has\nbeen freed: the worker is preemptible and not in an RCU read-side\ncritical section, so dropping the last reference first would let the\nBTF be freed while btf_record_free() still reads its fields.", "A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. During the teardown of certain BPF hash maps, the memory allocator destructor failed to retain a reference to the map's BPF Type Format (BTF) metadata, allowing the metadata to be freed while background cleanup tasks were still accessing it. A local user could exploit this vulnerability to trigger a use-after-free condition, resulting in a system crash and Denial of Service (DoS) or potential privilege escalation."], "name": "CVE-2026-98813", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98813\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98813\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98813.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1df97a7453eec80c1912c2d0360290a3970a7671,b506f5699e145196ee29d76cf1ca1cbb2202c055)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1df97a7453eec80c1912c2d0360290a3970a7671,ab39974240a0cff765f3bb9cce81d8001ffdb144)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "451a84a3ad3c897c03181af433e7c98640730f1f"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "51a17f0ce19c4ee2a25cf16c93490d509b1ebb0a"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T21:30:14.254243+00:00", "updated": "2026-10-24T03:15:14.622614+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}