{"id":"CVE-2026-98642","kind":"vulnerability","aliases":["CVE-2026-98642"],"related":[],"title":"Linux kernel: BPF memory allocator race lets a use-after-free occur","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk\n\nSyzkaller repeatedly triggered UAF splats related to nodes in\nwaiting_for_gp_ttrace within the bpf memalloc:\n\nBUG: KASAN: slab-use-after-free in llist_del_first+0x85/0x110 lib/llist.c:61\nRead of size 8 at addr ffff8881572cd080 by task syz.4.470/5112\n ...\n llist_del_first+0x85/0x110 lib/llist.c:61\n alloc_bulk+0x193/0x460 kernel/bpf/memalloc.c:229\n bpf_mem_refill+0x386/0x560 kernel/bpf/memalloc.c:436\n\nFreed by task 14:\n ...\n __free_rcu kernel/bpf/memalloc.c:281 [inline]\n __free_rcu_tasks_trace+0x48/0xd0 kernel/bpf/memalloc.c:291\n rcu_tasks_invoke_cbs+0x1ec/0x3e0 kernel/rcu/tasks.h:571\n rcu_tasks_one_gp+0x13d/0x220 kernel/rcu/tasks.h:621\n rcu_tasks_kthread+0xf3/0x120 kernel/rcu/tasks.h:651\n\nThe reason is that the UAF occurs after the RCU Tasks Trace GP expires:\nwhen the __free_rcu() callback runs, there is no synchronization\nprotecting llist_del_all() against concurrent alloc_bulk() operating on\nwaiting_for_gp_ttrace, leading to the race condition below:\n\nCPU0                                           CPU1\n                                               __free_rcu (RCU Tasks Trace callback)\nalloc_bulk\n  llist_del_first(&c->waiting_for_gp_ttrace)\n    entry = smp_load_acquire(&head->first);\n    do {\n      if (entry == NULL)\n        return NULL;\n                                               free_all(llist_del_all(&c->waiting_for_gp_ttrace))\n                                                 llist_for_each_safe(pos, t, llnode)\n                                                   free_one(pos);\n      next = READ_ONCE(entry->next); <-- trigger UAF\n    } while (!try_cmpxchg(&head->first, &entry, next));\n\nIn addition, there is also a theoretical race condition on the\nfree_by_rcu_ttrace list. This race requires two preconditions: an\nin-flight Tasks Trace GP keeping c->call_rcu_ttrace_in_progress == 1,\nand concurrent cross-CPU frees repopulating c->free_by_rcu_ttrace with\nnew nodes. Under these conditions, the following scenario triggers UAF:\n\n// CPU0\n// irq work is still busy (on PREEMPT_RT)\nalloc_bulk()\n  llist_del_first(&c->free_by_rcu_ttrace)\n    entry = smp_load_acquire(&head->first);\n    do {\n      if (entry == NULL)\n        return NULL;\n\n        // CPU1\n        bpf_mem_alloc_destroy()\n          WRITE_ONCE(c->draining, true)\n          // wait for CPU0\n          irq_work_sync()\n\n                // CPU2\n                do_call_rcu_ttrace(tgt(CPU0))\n                  if (c->draining) {\n                    llist_del_all(&c->free_by_rcu_ttrace)\n                    free_all()\n                  }\n\n// CPU0 continue\n      next = READ_ONCE(entry->next); <-- trigger UAF\n    while (!try_cmpxchg(&head->first, &entry, next));\n\nFix this by introducing a raw spinlock to synchronize the concurrent\nconsumption on waiting_for_gp_ttrace and free_by_rcu_ttrace.","summary":"Concurrent consumption of BPF memalloc lists (waiting_for_gp_ttrace and free_by_rcu_ttrace) can read freed nodes, a use-after-free detected by KASAN. The fix adds a raw spinlock to serialize access to those lists.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bpf","infrastructure","linux-kernel","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- `uname -r` to see the running kernel version, then compare it against the fixed kernel listed in the NVD record\n- unknown","fix":"- Update the Linux kernel to a release that includes the upstream commit fixing the BPF memalloc race (exact version unknown from the sources)","status":"open","published_at":"2026-10-18T16:17:17+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:20:53+00:00","updated_at":"2026-10-25T05:20:53+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:20:53Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit fixing the BPF memalloc race (exact version unknown from the sources)","reach":"local","title":"Linux kernel: BPF memory allocator race lets a use-after-free occur","impact":"high","summary":"Concurrent consumption of BPF memalloc lists (waiting_for_gp_ttrace and free_by_rcu_ttrace) can read freed nodes, a use-after-free detected by KASAN. The fix adds a raw spinlock to serialize access to those lists.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","bpf","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel memory corruption from a use-after-free could crash the system or enable privilege escalation","analyst_note":"Check the upstream kernel commit and stable backports to find the fixed kernel versions and whether unprivileged users can trigger BPF allocation paths.","how_to_check":"- `uname -r` to see the running kernel version, then compare it against the fixed kernel listed in the NVD record\n- unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Systems running a Linux kernel with BPF memory allocation in use, which is the BPF path for many eBPF programs and tracing tools. The sources do not say which kernel versions or configurations are affected, so unknown whether a system without BPF programs loaded is exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000732,"input_tokens":4538,"output_tokens":556,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':118C,135C,141C,148C,165C,173C,181C,188C '-2026':15A,18A '-98642':16A,19A '1':335C '14':155C '229':144C '281':159C '291':168C '436':151C '571':176C '61':121C,138C '621':184C '651':191C '8':125C 'access':63B 'acquir':257C,381C 'add':57B 'addit':301C 'addr':127C 'alloc':5A,88C,139C,222C,244C,368C,393C 'also':304C 'bpf':3A,20B,31B,77C,105C,145C,391C 'bug':107C 'bulk':89C,140C,223C,245C,369C 'busi':364C 'c':249C,271C,329C,343C,373C,397C,414C,419C 'call':330C,408C 'callback':210C,243C 'cbs':172C 'cmpxchg':295C,437C 'concurr':28B,82C,221C,337C,452C 'condit':234C,308C,353C 'consumpt':29B,83C,453C 'continu':427C 'cpu':340C 'cpu0':236C,359C,402C,412C,426C 'cpu1':237C,390C 'cpu2':406C 'cross':339C 'cross-cpu':338C 'cve':14A,17A 'del':116C,133C,218C,247C,269C,371C,417C 'destroy':394C 'detect':52B 'drain':398C,415C 'due':80C 'entri':254C,262C,289C,298C,378C,386C,431C,440C 'expir':205C 'ffff8881572cd080':128C 'first':117C,134C,248C,259C,297C,372C,383C,439C 'fix':56B,78C,442C 'flight':324C 'follow':72C,355C 'free':12A,39B,51B,113C,156C,161C,208C,238C,266C,283C,311C,341C,344C,374C,420C,424C,460C 'freed':45B,152C 'gp':36B,101C,180C,204C,228C,252C,274C,327C,457C 'head':258C,296C,382C,438C 'host':27B 'in-flight':322C 'infrastructur':21B 'inlin':160C 'introduc':445C 'invok':171C 'irq':360C,403C 'kasan':54B,108C 'keep':328C 'kernel':2A,24B,70C 'kernel/bpf/memalloc.c':143C,150C,158C,167C 'kernel/rcu/tasks.h':175C,183C,190C 'kthread':187C 'lead':230C 'let':7A 'lib/llist.c':120C,137C 'linux':1A,23B,69C 'linux-kernel':22B 'list':33B,66B,86C,315C 'llist':115C,132C,217C,246C,268C,276C,370C,416C 'llnode':282C 'load':256C,380C 'mem':146C,392C 'memalloc':32B,106C 'memori':4A 'new':349C 'next':286C,290C,299C,428C,432C,441C 'node':46B,97C,350C 'null':263C,265C,387C,389C 'occur':13A,198C 'one':179C,284C 'oper':224C 'pos':280C,285C 'precondit':320C 'preempt':366C 'progress':334C 'protect':216C 'race':6A,233C,307C,317C 'raw':59B,447C 'rcu':41B,157C,162C,169C,177C,185C,201C,209C,239C,240C,313C,331C,346C,376C,409C,422C,462C 'read':44B,122C,287C,429C 'reason':193C 'refil':147C 'relat':95C 'repeat':91C 'repopul':342C 'requir':318C 'resolv':76C 'return':264C,388C 'rt':367C 'run':211C 'safe':279C 'scenario':356C 'self':26B 'self-host':25B 'serial':62B 'size':124C 'slab':110C 'slab-use-after-fre':109C 'smp':255C,379C 'spinlock':60B,448C 'splat':94C 'still':363C 'sync':405C 'synchron':215C,450C 'syz.4.470/5112':131C 'syzkal':90C 'task':130C,154C,163C,170C,178C,186C,202C,241C,325C 'tgt':411C 'theoret':306C 'trace':164C,203C,242C,326C 'tri':294C,436C 'trigger':92C,291C,357C,433C 'true':399C 'ttrace':37B,42B,85C,102C,229C,253C,275C,314C,332C,347C,377C,410C,423C,458C,463C 'two':319C 'uaf':79C,93C,197C,292C,358C,434C 'use':10A,49B,111C 'use-after-fre':9A,48B 'vulner':73C 'wait':34B,99C,226C,250C,272C,400C,455C 'within':103C 'work':361C,404C 'write':395C 'x13d/0x220':182C 'x193/0x460':142C 'x1ec/0x3e0':174C 'x386/0x560':149C 'x48/0xd0':166C 'x85/0x110':119C,136C 'xf3/0x120':189C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with BPF memory allocation in use, which is the BPF path for many eBPF programs and tracing tools. The sources do not say which kernel versions or configurations are affected, so unknown whether a system without BPF programs loaded is exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98642","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98642","severity":null,"published_at":"2026-10-18T16:17:17+00:00","modified_at":"2026-10-19T10:19:28+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}