Cloudanix VulnDB

CVE-2026-98813

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in how Linux manages certain internal tracking structures for network and security programs can let attackers crash servers or potentially take them over.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in the BPF memory allocator destructor path when map BTF references are released too early during RCU-deferred free_mem_alloc_deferred work, allowing btf_is_kernel and btf_record_free to dereference freed slab memory for hash and rhash maps containing kptrs, list_head, or rb_root fields.

Why it matters to the business

Kernel crashes or memory corruption on Linux systems using BPF maps; potential local privilege escalation if exploited, leading to downtime or full host compromise especially on servers running recent kernels with complex BPF programs.

How an attack unfolds

An attacker crafts a BPF program using non-preallocated hash or resizable hash maps with map BTF types, loads it, then triggers map teardown under high element count conditions so RCU callbacks defer destruction; when the original BTF is freed the worker still dereferences stale pointers in btf_obj_free_fields.

How to fix it

Apply the upstream kernel patch that retains an extra map BTF reference inside the duplicated destructor record and releases it only after btf_record_free completes; upgrade to a kernel containing the fix for CVE-2026-98813.

How to confirm the fix worked

Confirm the fix by checking that bpf_ma_set_dtor now increments map BTF refcount and that btf_record_free is called only after the final reference drop; run syzkaller or targeted BPF map teardown tests under KASAN.

Typical attack path

  1. Load malicious or crafted BPF program attaching hash/rhash maps with local BTF types
  2. Populate maps beyond allocator high watermark
  3. Unload or free the map to queue RCU callbacks
  4. Trigger bpf_mem_alloc_destroy deferral to workqueue
  5. Wait for original BTF release while worker runs btf_record_free

How to detect it

Search kernel logs for KASAN slab-use-after-free involving btf_is_kernel, btf_record_free, htab_dtor_ctx_free and workqueue free_mem_alloc_deferred; inspect ftrace or perf traces of BPF map teardown under load.

What your security team should do

  • Prioritize kernel updates on systems exposing BPF to untrusted users or running production workloads with hash maps
  • Monitor for KASAN reports containing btf_is_kernel and free_mem_alloc_deferred
  • Restrict unprivileged BPF loading via sysctl until patched

The record

In the Linux kernel, the following vulnerability has been resolved: bpf: Hold map BTF for the memory allocator destructor record bpf_ma_set_dtor() duplicates map->record so that the bpf_mem_alloc destructor can release the special fields of hash and rhash map elements once the allocator frees them for good. btf_record_dup() only acquires references on kernel and module BTF. Fields whose types live in the map BTF keep pointing into it: a kptr to a local type refers to map->btf, and a list_head or rb_root field carries a value_rec owned by the struct meta table of map->btf. That borrowed state can outlive the map. When RCU callbacks are still in flight, bpf_mem_alloc_destroy() copies the allocator and defers the final drain, together with the destructor context, to a workqueue. bpf_map_free() then frees map->record and drops the map's BTF reference as soon as map_free() returns. Once the program that loaded the BTF is gone as well, the BTF is freed while the worker still uses the duplicate. The worker dereferences it through btf_is_kernel() and btf_find_struct_meta() in bpf_obj_free_fields() when destroying elements that were freed under RCU, and through btf_is_kernel() in btf_record_free() when releasing the context itself: BUG: KASAN: slab-use-after-free in btf_is_kernel+0x19/0x30 Read of size 1 at addr ffff88811505dce8 by task kworker/u16:2/50 Workqueue: events_unbound free_mem_alloc_deferred Call Trace: btf_is_kernel+0x19/0x30 btf_record_free+0xc7/0xf0 htab_dtor_ctx_free+0x1a/0x30 free_mem_alloc_no_barrier+0x39/0x230 free_mem_alloc_deferred+0x2a/0x40 process_scheduled_works+0x5ce/0x9d0 worker_thread+0x42a/0x5e0 kthread+0x1f5/0x230 ret_from_fork+0x1dd/0x390 ret_from_fork_asm+0x1a/0x30 Allocated by task 358: __kmalloc_cache_noprof+0x287/0x510 btf_new_fd+0xf7/0x3d0 __sys_bpf+0x487/0x840 Freed by task 0: kfree+0x186/0x560 rcu_core+0x6f6/0xd40 Freeing a map that still holds more elements than the allocator's high watermark is enough to get there, because the bulk free during teardown queues the RCU callback that makes bpf_mem_alloc_destroy() defer. Non-preallocated hash maps and resizable hash maps both register the destructor and are affected alike. Keep one reference on the map BTF in the destructor context. Every non-kernel pointer in the duplicated record is either map->btf or memory owned by it, so a single reference covers kptrs, list heads, and rb roots, and mirrors what bpf_map_meta_alloc() does for the duplicated record of an inner map. Release it only after the duplicated record has been freed: the worker is preemptible and not in an RCU read-side critical section, so dropping the last reference first would let the BTF be freed while btf_record_free() still reads its fields.

Affected packages

Ecosystem Package Introduced Fixed