{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98861", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.376Z", "datePublished": "2026-10-18T15:51:22.271Z", "dateUpdated": "2026-10-19T09:26:55.805Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:26:55.805Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()\n\nunregister_fprobe() and unregister_fprobe_async() (used by BPF\nkprobe-multi) rely on standard RCU grace periods (synchronize_rcu()\nand call_rcu()) to wait until in-flight fprobe handlers complete before\nfreeing the fprobe.\n\nHowever, if an fprobe handler executes while RCU is not watching (such\nas in the idle loop or nohz_full extended quiescent states), standard\nRCU does not track preemption-disabled sections. Consequently,\nsynchronize_rcu() does not wait for those executions, which can lead\nto a use-after-free if the fprobe is freed immediately after\nunregistration. Ensure handlers exit early when !rcu_is_watching().\n\nFurthermore, fprobe_fgraph_entry() and fprobe_ftrace_entry() previously\nused guard(rcu)() and rcu_read_lock(), which invoke lockdep on every\nhit under CONFIG_PROVE_LOCKING. This adds overhead and can cause lockdep\nrecursion if probed functions interact with lockdep.\n\nSince rhltable_lookup() and rhl_for_each_entry_rcu() use\nrcu_dereference_all_check() (which checks rcu_read_lock_any_held()),\nholding preemption disabled via rcu_read_lock_sched_notrace() is fully\nvalid and sufficient so long as rcu_is_watching() is true.\n\nDefine and use guard(rcu_sched_notrace)() across fprobe_ftrace_entry(),\nfprobe_fgraph_entry(), and fprobe_return(). This eliminates fast-path\nrcu_read_lock() and lockdep overhead while guaranteeing safe grace\nperiod synchronization."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/fprobe.c"], "versions": [{"version": "56b4cfcf1518245493c60fd39c56978f508f1816", "lessThan": "a85d0f00671b4d4527317c10ba018680f7d8d673", "status": "affected", "versionType": "git"}, {"version": "657b594b2084b39a4bc6d8493aa2140cb00cea49", "lessThan": "dd4a0d4993633b45470abf6da4ea0ca563402245", "status": "affected", "versionType": "git"}, {"version": "657b594b2084b39a4bc6d8493aa2140cb00cea49", "lessThan": "e0a6249190402a28f1e2925a81acf573157d55ef", "status": "affected", "versionType": "git"}, {"version": "a4f6a9005ed6cfd360ef2520430927f05f92ffb0", "status": "affected", "versionType": "git"}, {"version": "6.18.34", "lessThan": "6.18.56", "status": "affected", "versionType": "semver"}, {"version": "7.0.11", "lessThan": "7.1", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/fprobe.c"], "versions": [{"version": "7.1", "status": "affected"}, {"version": "0", "lessThan": "7.1", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.34", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.11"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a85d0f00671b4d4527317c10ba018680f7d8d673"}, {"url": "https://git.kernel.org/stable/c/dd4a0d4993633b45470abf6da4ea0ca563402245"}, {"url": "https://git.kernel.org/stable/c/e0a6249190402a28f1e2925a81acf573157d55ef"}], "title": "fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/trace/fprobe.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a85d0f00671b4d4527317c10ba018680f7d8d673", "status": "affected", "version": "56b4cfcf1518245493c60fd39c56978f508f1816", "versionType": "git"}, {"lessThan": "dd4a0d4993633b45470abf6da4ea0ca563402245", "status": "affected", "version": "657b594b2084b39a4bc6d8493aa2140cb00cea49", "versionType": "git"}, {"lessThan": "e0a6249190402a28f1e2925a81acf573157d55ef", "status": "affected", "version": "657b594b2084b39a4bc6d8493aa2140cb00cea49", "versionType": "git"}, {"status": "affected", "version": "a4f6a9005ed6cfd360ef2520430927f05f92ffb0", "versionType": "git"}, {"lessThan": "6.18.56", "status": "affected", "version": "6.18.34", "versionType": "semver"}, {"lessThan": "7.1", "status": "affected", "version": "7.0.11", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/trace/fprobe.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.1"}, {"lessThan": "7.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()\n\nunregister_fprobe() and unregister_fprobe_async() (used by BPF\nkprobe-multi) rely on standard RCU grace periods (synchronize_rcu()\nand call_rcu()) to wait until in-flight fprobe handlers complete before\nfreeing the fprobe.\n\nHowever, if an fprobe handler executes while RCU is not watching (such\nas in the idle loop or nohz_full extended quiescent states), standard\nRCU does not track preemption-disabled sections. Consequently,\nsynchronize_rcu() does not wait for those executions, which can lead\nto a use-after-free if the fprobe is freed immediately after\nunregistration. Ensure handlers exit early when !rcu_is_watching().\n\nFurthermore, fprobe_fgraph_entry() and fprobe_ftrace_entry() previously\nused guard(rcu)() and rcu_read_lock(), which invoke lockdep on every\nhit under CONFIG_PROVE_LOCKING. This adds overhead and can cause lockdep\nrecursion if probed functions interact with lockdep.\n\nSince rhltable_lookup() and rhl_for_each_entry_rcu() use\nrcu_dereference_all_check() (which checks rcu_read_lock_any_held()),\nholding preemption disabled via rcu_read_lock_sched_notrace() is fully\nvalid and sufficient so long as rcu_is_watching() is true.\n\nDefine and use guard(rcu_sched_notrace)() across fprobe_ftrace_entry(),\nfprobe_fgraph_entry(), and fprobe_return(). This eliminates fast-path\nrcu_read_lock() and lockdep overhead while guaranteeing safe grace\nperiod synchronization."}], "id": "CVE-2026-98861", "lastModified": "2026-10-19T10:19:50.187", "metrics": {}, "published": "2026-10-18T16:17:40.573", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a85d0f00671b4d4527317c10ba018680f7d8d673"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dd4a0d4993633b45470abf6da4ea0ca563402245"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e0a6249190402a28f1e2925a81acf573157d55ef"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via fprobe use-after-free", "id": "2555203", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555203"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nfprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()\nunregister_fprobe() and unregister_fprobe_async() (used by BPF\nkprobe-multi) rely on standard RCU grace periods (synchronize_rcu()\nand call_rcu()) to wait until in-flight fprobe handlers complete before\nfreeing the fprobe.\nHowever, if an fprobe handler executes while RCU is not watching (such\nas in the idle loop or nohz_full extended quiescent states), standard\nRCU does not track preemption-disabled sections. Consequently,\nsynchronize_rcu() does not wait for those executions, which can lead\nto a use-after-free if the fprobe is freed immediately after\nunregistration. Ensure handlers exit early when !rcu_is_watching().\nFurthermore, fprobe_fgraph_entry() and fprobe_ftrace_entry() previously\nused guard(rcu)() and rcu_read_lock(), which invoke lockdep on every\nhit under CONFIG_PROVE_LOCKING. This adds overhead and can cause lockdep\nrecursion if probed functions interact with lockdep.\nSince rhltable_lookup() and rhl_for_each_entry_rcu() use\nrcu_dereference_all_check() (which checks rcu_read_lock_any_held()),\nholding preemption disabled via rcu_read_lock_sched_notrace() is fully\nvalid and sufficient so long as rcu_is_watching() is true.\nDefine and use guard(rcu_sched_notrace)() across fprobe_ftrace_entry(),\nfprobe_fgraph_entry(), and fprobe_return(). This eliminates fast-path\nrcu_read_lock() and lockdep overhead while guaranteeing safe grace\nperiod synchronization.", "A flaw was found in the Linux kernel's function probe (fprobe) tracing mechanism. When handlers execute during inactive Read-Copy Update (RCU, a kernel synchronization mechanism) states, unregistration routines fail to wait for active handlers to complete before freeing memory. A privileged local attacker could exploit this flaw to trigger a use-after-free condition, leading to a Denial of Service (DoS) or potentially arbitrary code execution."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-98861", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-10-18T15:51:22Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98861\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98861\nhttps://git.kernel.org/stable/c/a85d0f00671b4d4527317c10ba018680f7d8d673\nhttps://git.kernel.org/stable/c/dd4a0d4993633b45470abf6da4ea0ca563402245\nhttps://git.kernel.org/stable/c/e0a6249190402a28f1e2925a81acf573157d55ef\nhttps://kernelcve.org/list/?q=CVE-2026-98861"], "statement": "A race in fprobe unregistration can cause a use after free because standard RCU grace periods do not wait for an in flight handler that runs while RCU is not watching. An fprobe object may therefore be freed after unregister_fprobe or unregister_fprobe_async while a handler executing in an idle loop or nohz_full state still references it. The demonstrated and most likely consequence is temporal memory corruption followed by a kernel crash. For the CVSS the PR:L value in the paranoid score reflects a restricted tracing or BPF capable local process that can manage multi kprobes without full system administration rights. Typical systems restrict these operations to root or processes with CAP_BPF, CAP_PERFMON, or CAP_SYS_ADMIN, so the realistic base score uses PR:H. The race requires a narrow timing condition and handler execution while RCU is not watching, so AC:H is appropriate. The issue is local and is not network reachable.", "threat_severity": "Moderate"}