{"id":"CVE-2026-98530","kind":"vulnerability","aliases":["CVE-2026-98530"],"related":[],"title":"Linux kernel: kprobes optimizer flush can hang the sysctl forever","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nkprobes: Fix permanent hang when flushing the kprobe optimizer\n\nWriting 0 to /proc/sys/debug/kprobes-optimization while a kprobe is\njump-optimized never returns. The writer sleeps in D state forever with\nkprobe_sysctl_mutex held, so any later read or write of that sysctl\nhangs as well. For example, with vfs_read+9 as an optimizable address\nin this build:\n\n  # cd /sys/kernel/tracing\n  # echo 'p:myprobe vfs_read+9' >> kprobe_events\n  # echo 1 > events/kprobes/myprobe/enable\n  # # wait until /sys/kernel/debug/kprobes/list shows [OPTIMIZED]\n  # echo 0 > /proc/sys/debug/kprobes-optimization\n\n  INFO: task sh:246 blocked for more than 10 seconds.\n  Call Trace:\n   <TASK>\n   __schedule+0x1176/0x4f70\n   schedule+0xdc/0x2c0\n   schedule_timeout+0x17b/0x260\n   wait_for_completion+0x173/0x3c0\n   wait_for_kprobe_optimizer_locked+0xbc/0x130\n   proc_kprobes_optimization_handler+0x156/0x1b0\n   proc_sys_call_handler+0x324/0x490\n   vfs_write+0x52d/0xfe0\n   ksys_write+0xff/0x200\n   do_syscall_64+0x106/0x630\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n   </TASK>\n  ...\n  INFO: task cat:265 is blocked on a mutex likely owned by task sh:246.\n\nwait_for_kprobe_optimizer_locked() reinitializes optimizer_completion,\nasks the optimizer thread to flush and sleeps in wait_for_completion().\nThe thread drains the (un)optimizing lists, but calls complete() only\nif completion_done() is true, i.e. if the completion is already done,\nwhich never happens while someone waits. disarm_all_kprobes() and\nkprobe_trace_self_tests_init() wait the same way.\n\nCalling complete() unconditionally would not be enough: the waiter\ndrops kprobe_mutex while it sleeps, and nothing else serializes the\nsysctl handler against the debugfs \"enabled\" file. A second flusher\nthat still finds the lists non-empty, e.g. because a disabled probe is\nqueued for unoptimizing, reinitializes the completion under the first:\n\n  sysctl write                      debugfs \"enabled\" write\n  unoptimize_all_kprobes()\n    wait_for_kprobe_optimizer_locked()\n      init_completion(c)\n      mutex_unlock(&kprobe_mutex)\n      wait_for_completion(c)\n                                    disarm_all_kprobes()\n                                      wait_for_kprobe_optimizer_locked()\n                                        init_completion(c)\n                                          // c->wait is reset, the first\n                                          // waiter is off the queue\n                                        mutex_unlock(&kprobe_mutex)\n                                        wait_for_completion(c)\n  kprobe_optimizer()\n    complete(c)\n      // wakes the debugfs writer only\n\nwhere c is &optimizer_completion. Lining up the two writes during an\noptimizer pass loses the sysctl writer this way.\n\nReplace the completion with a counter of optimizer passes, bumped at the\nend of each pass and signalled with wake_up_var_locked(), both under\nkprobe_mutex. A flusher samples the count and waits with\nwait_var_event_mutex(), which drops kprobe_mutex only while sleeping, so\na new count means a whole pass ran in the meantime. Nothing is\nreinitialized, so several flushers can sleep in the wait at once.","summary":"Writing 0 to /proc/sys/debug/kprobes-optimization while a kprobe is jump-optimized can leave the writer sleeping in D state with kprobe_sysctl_mutex held, so later reads or writes of that sysctl also hang. The sources describe a denial of service from a local hang, not code execution.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel-debugging","linux-kernel","other","self-hosted"],"not_affected_if":["kprobes-unused"],"how_to_check":"- `uname -r` and compare against the kernel version that contains the upstream kprobes fix\n- `cat /proc/sys/debug/kprobes-optimization` on a test host to see whether the sysctl responds\n- Check whether kprobes are in use: `cat /sys/kernel/debug/kprobes/list`","fix":"- Install the kernel build from your distribution that includes the upstream kprobes change (version unknown from sources)\n- Reboot into the patched kernel","status":"open","published_at":"2026-10-18T16:17:04+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:53+00:00","updated_at":"2026-10-25T05:23:53+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-25T05:23:53Z","model":"claude-haiku-5-5","output":{"fix":"- Install the kernel build from your distribution that includes the upstream kprobes change (version unknown from sources)\n- Reboot into the patched kernel","reach":"local","title":"Linux kernel: kprobes optimizer flush can hang the sysctl forever","impact":"low","summary":"Writing 0 to /proc/sys/debug/kprobes-optimization while a kprobe is jump-optimized can leave the writer sleeping in D state with kprobe_sysctl_mutex held, so later reads or writes of that sysctl also hang. The sources describe a denial of service from a local hang, not code execution.","category":"other","nicknames":[],"who_cares":["linux-kernel","self-hosted","kernel-debugging"],"confidence":0.5,"needs_auth":"unknown","worst_case":"local hang of kprobes sysctl until reboot","analyst_note":"Confirm the affected and fixed kernel version ranges and the upstream commit from the kernel.org or NVD entry; sources give no versions.","how_to_check":"- `uname -r` and compare against the kernel version that contains the upstream kprobes fix\n- `cat /proc/sys/debug/kprobes-optimization` on a test host to see whether the sysctl responds\n- Check whether kprobes are in use: `cat /sys/kernel/debug/kprobes/list`","needs_analyst":true,"not_affected_if":["kprobes-unused"],"who_is_affected":"Systems running a Linux kernel with kprobes optimization enabled that use kprobes or the debug sysctl, where a local user or process can write the sysctl. The sources do not name specific distributions or kernel versions. Hosts without kprobes use, or with the debug filesystem unmounted, are unlikely to be exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000772,"input_tokens":4517,"output_tokens":640,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':178C,181C,185C,190C,197C,203C,209C,213C,217C,222C,229C '+9':136C,151C '-2026':12A,15A '-98530':13A,16A '/proc/sys/debug/kprobes-optimization':30B,97C,164C '/sys/kernel/debug/kprobes/list':159C '/sys/kernel/tracing':145C '0':28B,95C,163C '1':155C '10':173C '246':168C,245C '265':234C '64':221C,226C 'address':140C 'alreadi':287C 'also':59B 'ask':254C 'block':169C,236C 'build':143C 'bump':453C 'c':376C,384C,395C,396C,414C,418C,425C 'call':175C,207C,274C,308C 'cat':233C 'cd':144C 'code':73B 'complet':189C,253C,265C,275C,278C,285C,309C,357C,375C,383C,394C,413C,417C,428C,446C 'count':475C,493C 'counter':449C 'cve':11A,14A 'd':44B,111C 'debug':19B 'debugf':332C,363C,421C 'denial':65B 'describ':63B 'disabl':349C 'disarm':295C,385C 'done':279C,288C 'drain':268C 'drop':317C,484C 'e.g':346C 'echo':146C,154C,162C 'els':325C 'empti':345C 'enabl':333C,364C 'end':456C 'enough':314C 'entri':224C 'event':153C,481C 'events/kprobes/myprobe/enable':156C 'exampl':132C 'execut':74B 'file':334C 'find':340C 'first':360C,401C 'fix':86C 'flush':5A,90C,259C 'flusher':337C,472C,507C 'follow':80C 'forev':10A,113C 'handler':202C,208C,329C 'hang':7A,60B,71B,88C,128C 'happen':291C 'held':50B,118C 'host':26B 'hwframe':228C 'i.e':282C 'info':165C,231C 'init':303C,374C,393C 'jump':36B,103C 'jump-optim':35B,102C 'kernel':2A,18B,22B,78C 'kernel-debug':17B 'kprobe':3A,33B,47B,85C,92C,100C,115C,152C,194C,200C,248C,297C,299C,318C,368C,371C,379C,387C,390C,409C,415C,469C,485C 'ksys':215C 'later':52B,121C 'leav':39B 'like':240C 'line':429C 'linux':1A,21B,77C 'linux-kernel':20B 'list':272C,342C 'local':70B 'lock':196C,250C,373C,392C,466C 'lose':438C 'mean':494C 'meantim':501C 'mutex':49B,117C,239C,319C,377C,380C,407C,410C,470C,482C,486C 'myprob':148C 'never':105C,290C 'new':492C 'non':344C 'non-empti':343C 'noth':324C,502C 'optim':4A,37B,93C,104C,161C,195C,201C,249C,252C,256C,271C,372C,391C,416C,427C,436C,451C 'optimiz':139C 'own':241C 'p':147C 'pass':437C,452C,459C,497C 'perman':87C 'probe':350C 'proc':199C,205C 'queu':352C 'queue':406C 'ran':498C 'read':53B,122C,135C,150C 'reiniti':251C,355C,504C 'replac':444C 'reset':399C 'resolv':84C 'return':106C 'sampl':473C 'schedul':177C,180C,183C 'second':174C,336C 'self':25B,301C 'self-host':24B 'serial':326C 'servic':67B 'sever':506C 'sh':167C,244C 'show':160C 'signal':461C 'sleep':42B,109C,261C,322C,489C,509C 'someon':293C 'sourc':62B 'state':45B,112C 'still':339C 'sys':206C 'syscal':220C,225C 'sysctl':9A,48B,58B,116C,127C,328C,361C,440C 'task':166C,232C,243C 'test':302C 'thread':257C,267C 'timeout':184C 'trace':176C,300C 'true':281C 'two':432C 'un':270C 'uncondit':310C 'unlock':378C,408C 'unoptim':354C,366C 'var':465C,480C 'vfs':134C,149C,211C 'vulner':81C 'wait':157C,187C,192C,246C,263C,294C,304C,369C,381C,388C,397C,411C,477C,479C,512C 'waiter':316C,402C 'wake':419C,463C 'way':307C,443C 'well':130C 'whole':496C 'would':311C 'write':27B,55B,94C,124C,212C,216C,362C,365C,433C 'writer':41B,108C,422C,441C 'x106/0x630':223C 'x1176/0x4f70':179C 'x156/0x1b0':204C 'x173/0x3c0':191C 'x17b/0x260':186C 'x324/0x490':210C 'x52d/0xfe0':214C 'x77/0x7f':230C 'xbc/0x130':198C 'xdc/0x2c0':182C 'xff/0x200':218C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with kprobes optimization enabled that use kprobes or the debug sysctl, where a local user or process can write the sysctl. The sources do not name specific distributions or kernel versions. Hosts without kprobes use, or with the debug filesystem unmounted, are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98530","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98530","severity":null,"published_at":"2026-10-18T16:17:04+00:00","modified_at":"2026-10-19T10:19:08+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}