CVE-2026-98642 - Vulnerability Details

- bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk

Syzkaller repeatedly triggered UAF splats related to nodes in
waiting_for_gp_ttrace within the bpf memalloc:

BUG: KASAN: slab-use-after-free in llist_del_first+0x85/0x110 lib/llist.c:61
Read of size 8 at addr ffff8881572cd080 by task syz.4.470/5112
...
llist_del_first+0x85/0x110 lib/llist.c:61
alloc_bulk+0x193/0x460 kernel/bpf/memalloc.c:229
bpf_mem_refill+0x386/0x560 kernel/bpf/memalloc.c:436

Freed by task 14:
...
__free_rcu kernel/bpf/memalloc.c:281 [inline]
__free_rcu_tasks_trace+0x48/0xd0 kernel/bpf/memalloc.c:291
rcu_tasks_invoke_cbs+0x1ec/0x3e0 kernel/rcu/tasks.h:571
rcu_tasks_one_gp+0x13d/0x220 kernel/rcu/tasks.h:621
rcu_tasks_kthread+0xf3/0x120 kernel/rcu/tasks.h:651

The reason is that the UAF occurs after the RCU Tasks Trace GP expires:
when the __free_rcu() callback runs, there is no synchronization
protecting llist_del_all() against concurrent alloc_bulk() operating on
waiting_for_gp_ttrace, leading to the race condition below:

CPU0 CPU1
__free_rcu (RCU Tasks Trace callback)
alloc_bulk
llist_del_first(&c->waiting_for_gp_ttrace)
entry = smp_load_acquire(&head->first);
do {
if (entry == NULL)
return NULL;
free_all(llist_del_all(&c->waiting_for_gp_ttrace))
llist_for_each_safe(pos, t, llnode)
free_one(pos);
next = READ_ONCE(entry->next); <-- trigger UAF
} while (!try_cmpxchg(&head->first, &entry, next));

In addition, there is also a theoretical race condition on the
free_by_rcu_ttrace list. This race requires two preconditions: an
in-flight Tasks Trace GP keeping c->call_rcu_ttrace_in_progress == 1,
and concurrent cross-CPU frees repopulating c->free_by_rcu_ttrace with
new nodes. Under these conditions, the following scenario triggers UAF:

// CPU0
// irq work is still busy (on PREEMPT_RT)
alloc_bulk()
llist_del_first(&c->free_by_rcu_ttrace)
entry = smp_load_acquire(&head->first);
do {
if (entry == NULL)
return NULL;

// CPU1
bpf_mem_alloc_destroy()
WRITE_ONCE(c->draining, true)
// wait for CPU0
irq_work_sync()

// CPU2
do_call_rcu_ttrace(tgt(CPU0))
if (c->draining) {
llist_del_all(&c->free_by_rcu_ttrace)
free_all()
}

// CPU0 continue
next = READ_ONCE(entry->next); <-- trigger UAF
while (!try_cmpxchg(&head->first, &entry, next));

Fix this by introducing a raw spinlock to synchronize the concurrent
consumption on waiting_for_gp_ttrace and free_by_rcu_ttrace.

Published: 2026-10-18

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a use‑after‑free triggered by concurrent consumption of BPF ttrace lists during bulk allocation. When the RCU task trace callback frees nodes, another CPU can delete them without proper synchronization, leading to a dangling pointer in the linked list. The resulting memory corruption is a classic kernel use‑after‑free that can be leveraged by an attacker to execute arbitrary code with kernel privileges, compromising confidentiality, integrity, and availability of the affected system.

Affected Systems

All Linux kernel builds that include the vulnerable BPF memalloc implementation are potentially affected. The CVE does not list specific released versions, only that the issue was addressed in recent commit history. Administrators should refer to their distribution’s kernel changelog or the provided kernel commit links to determine if their installed kernel contains the fix.

Risk and Exploitability

The CVSS score is not publicly available and the EPSS is not provided, so the quantified risk is unknown, but the vulnerability is not listed in the CISA KEV catalog. Given that it relies on a race in a low‑level kernel subsystem and requires concurrent BPF allocation activity, exploitation appears to be a local attack that may need elevated privileges or a carefully crafted workload. Nonetheless, the kernel nature of the flaw makes it high impact if successfully exploited.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`04fabf00b4d3aff5d010ecb617001814e409e24a`	affected	< a0e150a118025a05c8662c536ba2a865da86419c
`04fabf00b4d3aff5d010ecb617001814e409e24a`	affected	< 1d6581b544a88cf4348c2fb60dcb50ad63f012da
`04fabf00b4d3aff5d010ecb617001814e409e24a`	affected	< f101602415fb39a58941bec444df65634d5a6844
`04fabf00b4d3aff5d010ecb617001814e409e24a`	affected	< 1c21452d02eec2f008e2c5535820f85adbd7587a

Linux

affected

Version	Status	Constraints
`6.6`	affected	—
`0`	unaffected	< 6.6
`6.12.112`	unaffected	≤ 6.12.*
`6.18.55`	unaffected	≤ 6.18.*
`7.2.9`	unaffected	≤ 7.2.*
`7.3-rc5`	unaffected	≤ *

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the upstream commit fixing the use‑after‑free in bpf/memalloc.c
If an immediate upgrade is not possible, disable or limit BPF compilation and execution for untrusted users
Monitor system logs for signs of kernel crashes or memory corruption anomalies triggered by BPF activities

Generated by OpenCVE AI on October 18, 2026 at 19:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1c21452d02eec2f008e2c5535820f85adbd7587a
https://git.kernel.org/stable/c/1d6581b544a88cf4348c2fb60dcb50ad63f012da
https://git.kernel.org/stable/c/a0e150a118025a05c8662c536ba2a865da86419c
https://git.kernel.org/stable/c/f101602415fb39a58941bec444df65634d5a6844

History

Sun, 18 Oct 2026 19:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416 CWE-733

Sun, 18 Oct 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk Syzkaller repeatedly triggered UAF splats related to nodes in waiting_for_gp_ttrace within the bpf memalloc: BUG: KASAN: slab-use-after-free in llist_del_first+0x85/0x110 lib/llist.c:61 Read of size 8 at addr ffff8881572cd080 by task syz.4.470/5112 ... llist_del_first+0x85/0x110 lib/llist.c:61 alloc_bulk+0x193/0x460 kernel/bpf/memalloc.c:229 bpf_mem_refill+0x386/0x560 kernel/bpf/memalloc.c:436 Freed by task 14: ... __free_rcu kernel/bpf/memalloc.c:281 [inline] __free_rcu_tasks_trace+0x48/0xd0 kernel/bpf/memalloc.c:291 rcu_tasks_invoke_cbs+0x1ec/0x3e0 kernel/rcu/tasks.h:571 rcu_tasks_one_gp+0x13d/0x220 kernel/rcu/tasks.h:621 rcu_tasks_kthread+0xf3/0x120 kernel/rcu/tasks.h:651 The reason is that the UAF occurs after the RCU Tasks Trace GP expires: when the __free_rcu() callback runs, there is no synchronization protecting llist_del_all() against concurrent alloc_bulk() operating on waiting_for_gp_ttrace, leading to the race condition below: CPU0 CPU1 __free_rcu (RCU Tasks Trace callback) alloc_bulk llist_del_first(&c->waiting_for_gp_ttrace) entry = smp_load_acquire(&head->first); do { if (entry == NULL) return NULL; free_all(llist_del_all(&c->waiting_for_gp_ttrace)) llist_for_each_safe(pos, t, llnode) free_one(pos); next = READ_ONCE(entry->next); <-- trigger UAF } while (!try_cmpxchg(&head->first, &entry, next)); In addition, there is also a theoretical race condition on the free_by_rcu_ttrace list. This race requires two preconditions: an in-flight Tasks Trace GP keeping c->call_rcu_ttrace_in_progress == 1, and concurrent cross-CPU frees repopulating c->free_by_rcu_ttrace with new nodes. Under these conditions, the following scenario triggers UAF: // CPU0 // irq work is still busy (on PREEMPT_RT) alloc_bulk() llist_del_first(&c->free_by_rcu_ttrace) entry = smp_load_acquire(&head->first); do { if (entry == NULL) return NULL; // CPU1 bpf_mem_alloc_destroy() WRITE_ONCE(c->draining, true) // wait for CPU0 irq_work_sync() // CPU2 do_call_rcu_ttrace(tgt(CPU0)) if (c->draining) { llist_del_all(&c->free_by_rcu_ttrace) free_all() } // CPU0 continue next = READ_ONCE(entry->next); <-- trigger UAF while (!try_cmpxchg(&head->first, &entry, next)); Fix this by introducing a raw spinlock to synchronize the concurrent consumption on waiting_for_gp_ttrace and free_by_rcu_ttrace.
Title		bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1c21452d02eec2f008e2c5535820f85adbd7587a https://git.kernel.org/stable/c/1d6581b544a88cf4348c2fb60dcb50ad63f012da https://git.kernel.org/stable/c/a0e150a118025a05c8662c536ba2a865da86419c https://git.kernel.org/stable/c/f101602415fb39a58941bec444df65634d5a6844

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:20:13.740Z

Updated: 2026-10-18T15:20:13.740Z

Reserved: 2026-09-25T10:25:14.361Z

Link: CVE-2026-98642

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:17.367

Modified: 2026-10-18T16:17:17.367

Link: CVE-2026-98642

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-18T19:15:14Z

Weaknesses

CWE-416
Use After Free
CWE-733
Compiler Optimization Removal or Modification of Security-critical Code

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object