Cloudanix VulnDB

CVE-2026-98799

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux kernel can cause the system to crash when certain security or monitoring programs are removed while the kernel is still using them.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in BPF trampoline images: detaching a program drops its last reference and frees it after grace periods, but a task sleeping inside a prior sleepable prog can later invoke the already-freed prog via the trampoline, resulting in an int3 or other invalid instruction execution on x86.

Why it matters to the business

Kernel crashes and system instability on Linux hosts that use BPF-based tracing, LSM, or networking programs; environments with frequent program attach/detach operations face elevated risk of unplanned reboots or service disruption.

How an attack unfolds

An attacker or administrator detaches a BPF program from a trampoline while another CPU is sleeping inside an earlier sleepable fexit program attached to the same trampoline; upon wakeup the victim task executes through the now-freed program memory, triggering the use-after-free and kernel oops.

How to fix it

Upgrade to a Linux kernel containing the referenced fix that emits patchable nops before each prog call sequence and patches them to jumps on detach; lower BPF_MAX_TRAMP_LINKS on affected architectures as required.

How to confirm the fix worked

Confirm the kernel version includes the bpf_tramp_image_put and arch_bpf_trampoline_skip changes; attempt repeated attach/detach cycles of fexit programs under load and verify absence of int3 or KASAN reports in dmesg.

Typical attack path

  1. Attach multiple fexit or sleepable BPF programs via trampolines
  2. Trigger a detach of one program while tasks remain inside preceding sleepable programs
  3. Allow grace periods to expire and free the detached program
  4. Wake the sleeping task so it resumes execution into the freed program

How to detect it

Search kernel logs for oops containing bpf_trampoline, bpf_prog_enter, or int3 in poisoned bpf_prog_pack memory; correlate with BPF program detach events in audit or tracing logs.

What your security team should do

  • Prioritize kernel updates on any system running BPF LSM, tracing, or networking programs
  • Reduce frequency of program detach operations until patched
  • Monitor for unexplained kernel oops involving bpf_trampoline or bpf_prog_enter symbols

The record

In the Linux kernel, the following vulnerability has been resolved: bpf: Skip detached progs in trampoline images that are still in use bpf_tramp_image_put() makes sure a trampoline image is not freed while a task may still be running in it, but nothing similar is done for the progs called by that image. Detach drops the last prog reference right away and the prog is freed after grace periods, on the basis that a task still in the traced function skips the fexit progs once the nop at ip_after_call is patched to a jump. That leaves out a task sleeping in a sleepable prog that runs before the detached one, which no grace period waits for: CPU 0 CPU 1 in image I, sleeping in prog S detach P from I's trampoline -> new image, bpf_tramp_image_put(I) bpf_prog_put(P), last ref grace periods, P freed back from S __bpf_prog_enter(P) call P->bpf_func If S and P are fexit progs the task is already past the patched jump, and fentry only images don't have one. On x86 this is an int3 in poisoned bpf_prog_pack memory: Oops: int3: 0000 [#1] SMP NOPTI CPU: 18 UID: 0 PID: 94573 Comm: x169 Not tainted 6.18.44 #1 PREEMPT(lazy) RIP: 0010:0xffffffffc0601d8d Call Trace: <TASK> ? bpf_trampoline_6442515411+0x1a4/0x21b bpf_lsm_bprm_committed_creds+0x5/0x10 security_bprm_committed_creds+0x5f/0x70 begin_new_exec+0x2d6/0x410 ... We hit this in production when progs attached through trampolines got detached while their hooks were busy, and it was independently found with a fuzzer and KASAN. Have the JITs emit a patchable nop in front of each prog call sequence and record it in the image. When a prog is detached, patch its nop to a jump over the call sequence. Progs that stay attached keep running for the tasks that are in the image, and ip_after_call isn't needed anymore. The task can be in any image that isn't freed yet, not only in the current one. It sleeps in image I1 that calls S, P and Q, then P is detached and the trampoline moves to image I2, then Q is detached and its call is still in I1. So the trampoline keeps a list of its images until they are freed, and detaching a prog patches its nop in all of them. Images hold a reference on the trampoline for that long. On riscv and loongarch a jump of any range takes several instructions, and a task preempted in the middle of them could resume into half of the new sequence. The nop is a single instruction there, patched to a near branch through arch_bpf_trampoline_skip(). With the extra nops, BPF_MAX_TRAMP_LINKS progs no longer fit in a page on x86 and arm64 (and already didn't on powerpc), so lower the limit there like s390 does.

Affected packages

Ecosystem Package Introduced Fixed