CVE-2026-98378

What it actually does

Use-after-free in the BPF link iterator when bpf_link_get_curr_or_next() takes a reference on an ID-zero unsettled link that is concurrently freed after anon_inode_getfile() failure in bpf_link_prime().

Why it matters to the business

Kernel panic or memory corruption on Linux systems performing BPF operations, leading to denial of service or potential local privilege escalation; low exploitability reduces immediate risk but still requires prompt patching on affected kernels.

How an attack unfolds

An attacker with local access creates a BPF link that fails during anon_inode_getfile(), causing direct free of the unsettled link, while a concurrent iterator holds a dangling reference; subsequent bpf_link_put() in the iterator triggers slab-use-after-free and potential KASAN-detected panic.

How to fix it

Upgrade to a kernel containing the fix for bpf_link_get_curr_or_next() to skip ID-zero entries; apply the patch that treats unsettled links as transient identically to bpf_link_by_id().

How to confirm the fix worked

Confirm kernel version includes the bpf_link_seq_next and bpf_link_get_curr_or_next changes; run syzkaller or targeted BPF link iterator stress tests to verify absence of UAF reports.

Typical attack path

1. Obtain local code execution on target Linux kernel
2. Trigger concurrent BPF link creation that fails before settling
3. Perform BPF link iteration via bpf_seq_read or similar
4. Cause bpf_link_put on the freed object to trigger UAF

How to detect it

Search kernel logs for KASAN slab-use-after-free reports mentioning bpf_link_put or bpf_link_seq_next; inspect audit logs for unusual BPF syscall sequences around link creation and iteration.

What your security team should do

• Prioritize kernel updates on all production Linux systems within 30 days
• Monitor for local BPF-related crashes in logs
• Restrict unprivileged BPF access via sysctl where possible until patched