{"id":"CVE-2026-98799","kind":"vulnerability","aliases":["CVE-2026-98799"],"related":[],"title":"Linux kernel BPF: detached trampoline progs can run freed memory, crashing the kernel","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Skip detached progs in trampoline images that are still in use\n\nbpf_tramp_image_put() makes sure a trampoline image is not freed while\na task may still be running in it, but nothing similar is done for the\nprogs called by that image. Detach drops the last prog reference right\naway and the prog is freed after grace periods, on the basis that a\ntask still in the traced function skips the fexit progs once the nop at\nip_after_call is patched to a jump.\n\nThat leaves out a task sleeping in a sleepable prog that runs before\nthe detached one, which no grace period waits for:\n\n  CPU 0                               CPU 1\n  in image I, sleeping in prog S\n                                      detach P from I's trampoline\n                                       -> new image, bpf_tramp_image_put(I)\n                                      bpf_prog_put(P), last ref\n                                      grace periods, P freed\n  back from S\n  __bpf_prog_enter(P)\n  call P->bpf_func\n\nIf S and P are fexit progs the task is already past the patched jump,\nand fentry only images don't have one. On x86 this is an int3 in\npoisoned bpf_prog_pack memory:\n\n  Oops: int3: 0000 [#1] SMP NOPTI\n  CPU: 18 UID: 0 PID: 94573 Comm: x169 Not tainted 6.18.44 #1 PREEMPT(lazy)\n  RIP: 0010:0xffffffffc0601d8d\n  Call Trace:\n   <TASK>\n   ? bpf_trampoline_6442515411+0x1a4/0x21b\n   bpf_lsm_bprm_committed_creds+0x5/0x10\n   security_bprm_committed_creds+0x5f/0x70\n   begin_new_exec+0x2d6/0x410\n   ...\n\nWe hit this in production when progs attached through trampolines got\ndetached while their hooks were busy, and it was independently found\nwith a fuzzer and KASAN.\n\nHave the JITs emit a patchable nop in front of each prog call sequence\nand record it in the image. When a prog is detached, patch its nop to a\njump over the call sequence. Progs that stay attached keep running for\nthe tasks that are in the image, and ip_after_call isn't needed anymore.\n\nThe task can be in any image that isn't freed yet, not only in the\ncurrent one. It sleeps in image I1 that calls S, P and Q, then P is\ndetached and the trampoline moves to image I2, then Q is detached and\nits call is still in I1. So the trampoline keeps a list of its images\nuntil they are freed, and detaching a prog patches its nop in all of\nthem. Images hold a reference on the trampoline for that long.\n\nOn riscv and loongarch a jump of any range takes several instructions,\nand a task preempted in the middle of them could resume into half of the\nnew sequence. The nop is a single instruction there, patched to a near\nbranch through arch_bpf_trampoline_skip().\n\nWith the extra nops, BPF_MAX_TRAMP_LINKS progs no longer fit in a page\non x86 and arm64 (and already didn't on powerpc), so lower the limit\nthere like s390 does.","summary":"When a BPF program is detached from a trampoline while another sleeping program in the same trampoline image is still running, the kernel can free the detached program too early and then call it, causing a kernel oops (int3 on x86). The sources describe a crash in a production kernel and a KASAN-found bug; they do not state a confirmed privilege escalation.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bpf","kubernetes","linux-kernel","runtime","self-hosted"],"not_affected_if":["default-config"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:33+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:15:06+00:00","updated_at":"2026-10-25T05:15:06+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:15:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel BPF: detached trampoline progs can run freed memory, crashing the kernel","impact":"high","summary":"When a BPF program is detached from a trampoline while another sleeping program in the same trampoline image is still running, the kernel can free the detached program too early and then call it, causing a kernel oops (int3 on x86). The sources describe a crash in a production kernel and a KASAN-found bug; they do not state a confirmed privilege escalation.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","bpf","self-hosted","kubernetes"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel crash via int3 oops; possible code execution in kernel context","analyst_note":"Find the fixed kernel stable versions and distro advisories for CVE-2026-98799 from the NVD entry and the kernel stable git log for the 'Skip detached progs in trampoline images' commit.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Linux systems running a kernel that includes this BPF trampoline change, where BPF programs (fentry/fexit/LSM) are attached and detached at runtime. Hosts that do not use BPF trampolines, or run kernels without this fix, should check their kernel version against their distribution's advisory. The sources do not give affected kernel version ranges.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000692,"input_tokens":4264,"output_tokens":532,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':321C,328C,334C,339C '-2026':15A,18A '-98799':16A,19A '0':214C,302C '0000':295C '0010':314C '0xffffffffc0601d8d':315C '1':216C,296C,310C '18':300C '6.18.44':309C '6442515411':320C '94573':304C 'alreadi':268C,576C 'anoth':39B 'anymor':424C 'arch':552C 'arm64':574C 'attach':348C,406C 'away':155C 'back':247C 'basi':166C 'begin':336C 'bpf':3A,20B,31B,103C,115C,232C,237C,250C,256C,289C,318C,323C,553C,560C 'bprm':325C,331C 'branch':550C 'bug':84B 'busi':357C 'call':61B,144C,185C,254C,316C,380C,401C,420C,449C,471C 'caus':63B 'comm':305C 'commit':326C,332C 'confirm':90B 'could':531C 'cpu':213C,215C,299C 'crash':11A,74B 'cred':327C,333C 'current':441C 'cve':14A,17A 'describ':72B 'detach':4A,34B,55B,105C,148C,205C,224C,352C,392C,457C,468C,490C 'didn':577C 'done':140C 'drop':149C 'earli':58B 'emit':371C 'enter':252C 'escal':92B 'exec':338C 'extra':558C 'fentri':274C 'fexit':177C,263C 'fit':567C 'follow':98C 'found':83B,362C 'free':53B 'freed':9A,126C,160C,246C,435C,488C 'front':376C 'func':257C 'function':174C 'fuzzer':365C 'got':351C 'grace':162C,209C,243C 'half':534C 'hit':342C 'hold':501C 'hook':355C 'host':28B 'i1':447C,475C 'i2':464C 'imag':46B,109C,117C,123C,147C,218C,231C,234C,276C,387C,416C,431C,446C,463C,484C,500C 'independ':361C 'instruct':521C,544C 'int3':67B,286C,294C 'ip':183C,418C 'isn':421C,433C 'jit':370C 'jump':190C,272C,398C,515C 'kasan':82B,367C 'kasan-found':81B 'keep':407C,479C 'kernel':2A,13A,24B,51B,65B,78B,96C 'kubernet':21B 'last':151C,241C 'lazi':312C 'leav':192C 'like':586C 'limit':584C 'link':563C 'linux':1A,23B,95C 'linux-kernel':22B 'list':481C 'long':509C 'longer':566C 'loongarch':513C 'lower':582C 'lsm':324C 'make':119C 'max':561C 'may':130C 'memori':10A,292C 'middl':528C 'move':461C 'near':549C 'need':423C 'new':230C,337C,537C 'nop':181C,374C,395C,495C,540C,559C 'nopti':298C 'noth':137C 'one':206C,280C,442C 'oop':66B,293C 'p':225C,240C,245C,253C,255C,261C,451C,455C 'pack':291C 'page':570C 'past':269C 'patch':187C,271C,393C,493C,546C 'patchabl':373C 'period':163C,210C,244C 'pid':303C 'poison':288C 'powerpc':580C 'preempt':311C,525C 'privileg':91B 'product':77B,345C 'prog':6A,106C,143C,152C,158C,178C,200C,222C,238C,251C,264C,290C,347C,379C,390C,403C,492C,564C 'program':32B,41B,56B 'put':118C,235C,239C 'q':453C,466C 'rang':518C 'record':383C 'ref':242C 'refer':153C,503C 'resolv':102C 'resum':532C 'right':154C 'rip':313C 'riscv':511C 'run':8A,49B,133C,202C,408C 'runtim':25B 's390':587C 'secur':330C 'self':27B 'self-host':26B 'sequenc':381C,402C,538C 'sever':520C 'similar':138C 'singl':543C 'skip':104C,175C,555C 'sleep':40B,196C,220C,444C 'sleepabl':199C 'smp':297C 'sourc':71B 'state':88B 'stay':405C 'still':48B,112C,131C,170C,473C 'sure':120C 'taint':308C 'take':519C 'task':129C,169C,195C,266C,411C,426C,524C 'trace':173C,317C 'tramp':116C,233C,562C 'trampolin':5A,37B,45B,108C,122C,229C,319C,350C,460C,478C,506C,554C 'uid':301C 'use':114C 'vulner':99C 'wait':211C 'x169':306C 'x1a4/0x21b':322C 'x2d6/0x410':340C 'x5/0x10':329C 'x5f/0x70':335C 'x86':69B,282C,572C 'yet':436C","nicknames":[],"mitigations":[],"who_affected":"Linux systems running a kernel that includes this BPF trampoline change, where BPF programs (fentry/fexit/LSM) are attached and detached at runtime. Hosts that do not use BPF trampolines, or run kernels without this fix, should check their kernel version against their distribution's advisory. The sources do not give affected kernel version ranges.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98799","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98799","severity":null,"published_at":"2026-10-18T16:17:33+00:00","modified_at":"2026-10-19T10:19:43+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}