---
id: "CVE-2026-98540"
kind: "vulnerability"
aliases: ["CVE-2026-98540"]
title: "Linux kernel fprobe: unused tracing slots can run exit handlers twice"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "linux-kernel", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-18T16:17:05+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T05:23:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98540", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# Linux kernel fprobe: unused tracing slots can run exit handlers twice

In the Linux kernel's fprobe tracing code, the return path can read leftover data from an unused slot, so an exit handler may run twice or run after its entry handler asked to skip it. The sources do not describe a direct way for an attacker to gain code execution or read data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Move to a Linux kernel release that includes the upstream fprobe fix (the commit that terminates the fgraph_data list); the sources do not name the fixed version.

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98540

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

fprobe: Terminate the fgraph_data list when the reservation is not filled

fprobe_fgraph_entry() reserves shadow stack space for every fprobe with
an exit handler, but only fills it for those whose entry handler returns
0. fgraph_reserve_data() does not clear the area, so fprobe_return()
parses the unused tail as headers left over from an earlier call, and an
exit handler can run twice or despite its entry handler asking to skip
it.

Write a zero word after the last entry to terminate the walk. A zeroed
slot does not decode to a NULL fprobe on the arches that encode the
header into one unsigned long, since arch_decode_fprobe_header_fp() ORs
in FPROBE_HEADER_MSB_PATTERN, so make read_fprobe_header() return NULL
for a zeroed slot.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_