{"id":"CVE-2026-98813","kind":"vulnerability","aliases":["CVE-2026-98813"],"related":[],"title":"Linux kernel: BPF map teardown can free BTF still in use, causing use-after-free","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Hold map BTF for the memory allocator destructor record\n\nbpf_ma_set_dtor() duplicates map->record so that the bpf_mem_alloc\ndestructor can release the special fields of hash and rhash map elements\nonce the allocator frees them for good. btf_record_dup() only acquires\nreferences on kernel and module BTF. Fields whose types live in the map\nBTF keep pointing into it: a kptr to a local type refers to map->btf,\nand a list_head or rb_root field carries a value_rec owned by the struct\nmeta table of map->btf.\n\nThat borrowed state can outlive the map. When RCU callbacks are still in\nflight, bpf_mem_alloc_destroy() copies the allocator and defers the final\ndrain, together with the destructor context, to a workqueue.\nbpf_map_free() then frees map->record and drops the map's BTF reference\nas soon as map_free() returns. Once the program that loaded the BTF is\ngone as well, the BTF is freed while the worker still uses the\nduplicate. The worker dereferences it through btf_is_kernel() and\nbtf_find_struct_meta() in bpf_obj_free_fields() when destroying elements\nthat were freed under RCU, and through btf_is_kernel() in\nbtf_record_free() when releasing the context itself:\n\n  BUG: KASAN: slab-use-after-free in btf_is_kernel+0x19/0x30\n  Read of size 1 at addr ffff88811505dce8 by task kworker/u16:2/50\n  Workqueue: events_unbound free_mem_alloc_deferred\n  Call Trace:\n   btf_is_kernel+0x19/0x30\n   btf_record_free+0xc7/0xf0\n   htab_dtor_ctx_free+0x1a/0x30\n   free_mem_alloc_no_barrier+0x39/0x230\n   free_mem_alloc_deferred+0x2a/0x40\n   process_scheduled_works+0x5ce/0x9d0\n   worker_thread+0x42a/0x5e0\n   kthread+0x1f5/0x230\n   ret_from_fork+0x1dd/0x390\n   ret_from_fork_asm+0x1a/0x30\n\n  Allocated by task 358:\n   __kmalloc_cache_noprof+0x287/0x510\n   btf_new_fd+0xf7/0x3d0\n   __sys_bpf+0x487/0x840\n\n  Freed by task 0:\n   kfree+0x186/0x560\n   rcu_core+0x6f6/0xd40\n\nFreeing a map that still holds more elements than the allocator's high\nwatermark is enough to get there, because the bulk free during teardown\nqueues the RCU callback that makes bpf_mem_alloc_destroy() defer.\nNon-preallocated hash maps and resizable hash maps both register the\ndestructor and are affected alike.\n\nKeep one reference on the map BTF in the destructor context. Every\nnon-kernel pointer in the duplicated record is either map->btf or memory\nowned by it, so a single reference covers kptrs, list heads, and rb\nroots, and mirrors what bpf_map_meta_alloc() does for the duplicated\nrecord of an inner map. Release it only after the duplicated record has\nbeen freed: the worker is preemptible and not in an RCU read-side\ncritical section, so dropping the last reference first would let the\nBTF be freed while btf_record_free() still reads its fields.","summary":"When a BPF hash map is freed while RCU callbacks are pending, the deferred destructor can read BTF memory that was already freed. The sources describe a kernel use-after-free (KASAN report) that can be reached by freeing a map with more elements than the allocator's high watermark.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bpf","kubernetes","linux-kernel","runtime","self-hosted"],"not_affected_if":["no-ebpf-programs-loaded"],"how_to_check":"- Check the running kernel version with `uname -r` and compare it against the fixed kernel versions in the NVD entry (unknown in the sources)\n- Check whether BPF is in use: `bpftool map list` on hosts that load eBPF programs (unknown whether this is needed)","fix":"- Update the Linux kernel to a release that includes the upstream fix for CVE-2026-98813 (fixed version unknown in the sources)\n- Reboot after the kernel update so the fixed kernel is running","status":"open","published_at":"2026-10-18T16:17:35+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:14:50+00:00","updated_at":"2026-10-25T05:14:50+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:14:50Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for CVE-2026-98813 (fixed version unknown in the sources)\n- Reboot after the kernel update so the fixed kernel is running","reach":"local","title":"Linux kernel: BPF map teardown can free BTF still in use, causing use-after-free","impact":"high","summary":"When a BPF hash map is freed while RCU callbacks are pending, the deferred destructor can read BTF memory that was already freed. The sources describe a kernel use-after-free (KASAN report) that can be reached by freeing a map with more elements than the allocator's high watermark.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","bpf","self-hosted","kubernetes"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel memory corruption; possible code execution or crash","analyst_note":"Find the fixed kernel versions and affected stable branches from the NVD entry or the upstream kernel commit, and confirm whether an unprivileged local user can load BPF programs to trigger it.","how_to_check":"- Check the running kernel version with `uname -r` and compare it against the fixed kernel versions in the NVD entry (unknown in the sources)\n- Check whether BPF is in use: `bpftool map list` on hosts that load eBPF programs (unknown whether this is needed)","needs_analyst":true,"not_affected_if":["no-ebpf-programs-loaded"],"who_is_affected":"The flaw is in the kernel's BPF map code, so it applies to Linux hosts where BPF maps of the non-preallocated or resizable hash types are created and freed. The sources say nothing about which distributions or kernel versions are affected, so systems that do not load BPF programs are probably less exposed but this is not confirmed. Unknown whether untrusted local users can trigger it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000777,"input_tokens":4368,"output_tokens":681,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':316C,341C,346C,352C,359C,365C,370C,374C,377C,382C,388C,397C,402C,406C,413C,417C '-2026':18A,21A '-98813':19A,22A '0':411C '1':321C '2/50':328C '358':393C 'acquir':139C 'addr':323C 'affect':470C 'alik':471C 'alloc':79B,100C,115C,130C,205C,209C,334C,356C,363C,390C,429C,452C,518C 'alreadi':53B 'asm':387C 'barrier':358C 'borrow':190C 'bpf':3A,23B,34B,93C,103C,113C,203C,223C,279C,405C,450C,515C 'btf':8A,49B,96C,135C,145C,153C,167C,188C,235C,249C,255C,270C,274C,293C,297C,313C,338C,343C,399C,478C,495C,561C,565C 'bug':305C 'bulk':440C 'cach':395C 'call':336C 'callback':41B,198C,447C 'carri':176C 'caus':12A 'context':219C,303C,482C 'copi':207C 'core':416C 'cover':505C 'critic':550C 'ctx':350C 'cve':17A,20A 'defer':45B,211C,335C,364C,454C 'derefer':267C 'describ':57B 'destroy':206C,284C,453C 'destructor':46B,101C,116C,218C,467C,481C 'drain':214C 'drop':231C,553C 'dtor':106C,349C 'dup':137C 'duplic':107C,264C,490C,522C,533C 'either':493C 'element':76B,127C,285C,426C 'enough':434C 'event':330C 'everi':483C 'fd':401C 'ffff88811505dce8':324C 'field':121C,146C,175C,282C,571C 'final':213C 'find':275C 'first':557C 'flight':202C 'follow':88C 'fork':381C,386C 'free':7A,16A,63B,71B,131C,225C,227C,241C,281C,299C,311C,332C,345C,351C,354C,361C,419C,441C,567C 'freed':38B,54B,257C,288C,408C,537C,563C 'get':436C 'gone':251C 'good':134C 'hash':35B,123C,458C,462C 'head':171C,508C 'high':81B,431C 'hold':94C,424C 'host':31B 'htab':348C 'inner':526C 'kasan':64B,306C 'keep':154C,472C 'kernel':2A,27B,59B,86C,142C,272C,295C,315C,340C,486C 'kfree':412C 'kmalloc':394C 'kptr':159C 'kptrs':506C 'kthread':376C 'kubernet':24B 'kworker/u16':327C 'last':555C 'let':559C 'linux':1A,26B,85C 'linux-kernel':25B 'list':170C,507C 'live':149C 'load':247C 'local':162C 'ma':104C 'make':449C 'map':4A,36B,73B,95C,108C,126C,152C,166C,187C,195C,224C,228C,233C,240C,421C,459C,463C,477C,494C,516C,527C 'mem':114C,204C,333C,355C,362C,451C 'memori':50B,99C,497C 'meta':184C,277C,517C 'mirror':513C 'modul':144C 'new':400C 'non':456C,485C 'non-kernel':484C 'non-prealloc':455C 'noprof':396C 'obj':280C 'one':473C 'outliv':193C 'own':180C,498C 'pend':43B 'point':155C 'pointer':487C 'prealloc':457C 'preemptibl':541C 'process':367C 'program':245C 'queue':444C 'rb':173C,510C 'rcu':40B,197C,290C,415C,446C,546C 'reach':69B 'read':48B,318C,548C,569C 'read-sid':547C 'rec':179C 'record':102C,109C,136C,229C,298C,344C,491C,523C,534C,566C 'refer':140C,164C,236C,474C,504C,556C 'regist':465C 'releas':118C,301C,528C 'report':65B 'resiz':461C 'resolv':92C 'ret':379C,384C 'return':242C 'rhash':125C 'root':174C,511C 'runtim':28B 'schedul':368C 'section':551C 'self':30B 'self-host':29B 'set':105C 'side':549C 'singl':503C 'size':320C 'slab':308C 'slab-use-after-fre':307C 'soon':238C 'sourc':56B 'special':120C 'state':191C 'still':9A,200C,261C,423C,568C 'struct':183C,276C 'sys':404C 'tabl':185C 'task':326C,392C,410C 'teardown':5A,443C 'thread':373C 'togeth':215C 'trace':337C 'type':148C,163C 'unbound':331C 'use':11A,14A,61B,262C,309C 'use-after-fre':13A,60B 'valu':178C 'vulner':89C 'watermark':82B,432C 'well':253C 'whose':147C 'work':369C 'worker':260C,266C,372C,539C 'workqueu':222C,329C 'would':558C 'x186/0x560':414C 'x19/0x30':317C,342C 'x1a/0x30':353C,389C 'x1dd/0x390':383C 'x1f5/0x230':378C 'x287/0x510':398C 'x2a/0x40':366C 'x39/0x230':360C 'x42a/0x5e0':375C 'x487/0x840':407C 'x5ce/0x9d0':371C 'x6f6/0xd40':418C 'xc7/0xf0':347C 'xf7/0x3d0':403C","nicknames":[],"mitigations":[],"who_affected":"The flaw is in the kernel's BPF map code, so it applies to Linux hosts where BPF maps of the non-preallocated or resizable hash types are created and freed. The sources say nothing about which distributions or kernel versions are affected, so systems that do not load BPF programs are probably less exposed but this is not confirmed. Unknown whether untrusted local users can trigger it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98813","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98813","severity":null,"published_at":"2026-10-18T16:17:35+00:00","modified_at":"2026-10-19T10:19:45+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}