CVE-2026-98789

What it actually does

The vulnerability allows an unbounded number of objects to remain stuck in the free_by_rcu_ttrace list of the BPF memory allocator because do_call_rcu_ttrace() returns early when call_rcu_ttrace_in_progress is set, while __free_rcu() only clears the flag after freeing waiting_for_gp_ttrace objects.

Why it matters to the business

Kernel memory can gradually exhaust on systems that create and destroy many BPF maps, leading to resource starvation, performance degradation, or crashes in production environments that rely on eBPF for networking, security, or observability.

How an attack unfolds

An attacker repeatedly triggers BPF map allocation and deallocation paths that invoke free_bulk() or __free_by_rcu() while an RCU tasks trace grace period is active; the early return in do_call_rcu_ttrace() leaves objects stranded, and because the count is unbounded the attacker can drive memory consumption until the system becomes unstable.

How to fix it

Upgrade the Linux kernel to a version containing the three-state call_rcu_ttrace_in_progress fix and the associated queuing changes under rcu_read_lock with synchronize_rcu before barriers; rebuild and reboot all affected hosts.

How to confirm the fix worked

Confirm the patched kernel source contains the state-machine logic (idle/queued/draining) for call_rcu_ttrace_in_progress and the updated do_call_rcu_ttrace/__free_rcu paths; run stress tests that repeatedly create/destroy BPF maps while monitoring bpf_mem_cache object counts.

Typical attack path

1. Obtain ability to load and manipulate BPF programs or maps (unprivileged or via a compromised process)
2. Create and immediately destroy large numbers of BPF hash maps in rapid succession
3. Force concurrent RCU tasks trace grace periods by interleaving allocations with rcu_barrier_tasks_trace calls
4. Accumulate objects in free_by_rcu_ttrace until kernel memory pressure becomes critical

How to detect it

Inspect kernel logs and BPF allocator statistics for sustained growth in free_by_rcu_ttrace objects without corresponding frees; correlate with processes performing frequent BPF map create/destroy cycles.

What your security team should do

• Prioritize kernel updates on all production systems within the next maintenance window
• Temporarily restrict unprivileged BPF map creation via sysctl or seccomp where feasible
• Add kernel memory usage and BPF allocator metrics to existing monitoring dashboards
• Review and reduce the attack surface of workloads that dynamically create short-lived BPF maps