{"id":"CVE-2026-98861","kind":"vulnerability","aliases":["CVE-2026-98861"],"related":[],"title":"Linux kernel: fprobe handlers can run during RCU idle and use freed memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()\n\nunregister_fprobe() and unregister_fprobe_async() (used by BPF\nkprobe-multi) rely on standard RCU grace periods (synchronize_rcu()\nand call_rcu()) to wait until in-flight fprobe handlers complete before\nfreeing the fprobe.\n\nHowever, if an fprobe handler executes while RCU is not watching (such\nas in the idle loop or nohz_full extended quiescent states), standard\nRCU does not track preemption-disabled sections. Consequently,\nsynchronize_rcu() does not wait for those executions, which can lead\nto a use-after-free if the fprobe is freed immediately after\nunregistration. Ensure handlers exit early when !rcu_is_watching().\n\nFurthermore, fprobe_fgraph_entry() and fprobe_ftrace_entry() previously\nused guard(rcu)() and rcu_read_lock(), which invoke lockdep on every\nhit under CONFIG_PROVE_LOCKING. This adds overhead and can cause lockdep\nrecursion if probed functions interact with lockdep.\n\nSince rhltable_lookup() and rhl_for_each_entry_rcu() use\nrcu_dereference_all_check() (which checks rcu_read_lock_any_held()),\nholding preemption disabled via rcu_read_lock_sched_notrace() is fully\nvalid and sufficient so long as rcu_is_watching() is true.\n\nDefine and use guard(rcu_sched_notrace)() across fprobe_ftrace_entry(),\nfprobe_fgraph_entry(), and fprobe_return(). This eliminates fast-path\nrcu_read_lock() and lockdep overhead while guaranteeing safe grace\nperiod synchronization.","summary":"In the Linux kernel's fprobe tracing code, probe handlers can run while RCU is not watching, so unregistering a probe may free it while a handler still uses it. The sources do not state what an attacker can do beyond a possible use-after-free in the kernel.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bpf","linux-kernel","other","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- `uname -r` to see the running kernel version\n- unknown","fix":"- Update the Linux kernel to a release that includes the upstream fprobe fix (the sources do not name a fixed version)\n- unknown","status":"open","published_at":"2026-10-18T16:17:40+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:12:53+00:00","updated_at":"2026-10-25T05:12:53+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-25T05:12:53Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fprobe fix (the sources do not name a fixed version)\n- unknown","reach":"local","title":"Linux kernel: fprobe handlers can run during RCU idle and use freed memory","impact":"medium","summary":"In the Linux kernel's fprobe tracing code, probe handlers can run while RCU is not watching, so unregistering a probe may free it while a handler still uses it. The sources do not state what an attacker can do beyond a possible use-after-free in the kernel.","category":"other","nicknames":[],"who_cares":["linux-kernel","bpf","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; possible kernel use-after-free","analyst_note":"Find the fixed kernel versions and the affected stable branches from the NVD entry and the kernel.org stable commit for the fprobe rcu_sched_notrace change.","how_to_check":"- `uname -r` to see the running kernel version\n- unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Systems running a Linux kernel with fprobe, including setups that use BPF kprobe-multi probes that get unregistered at runtime, are the likely exposure. The sources do not say which kernel versions are affected or which configurations use fprobe by default. unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00064,"input_tokens":3844,"output_tokens":512,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98861':16A,19A 'across':291C 'add':228C 'async':104C 'attack':65B 'beyond':68B 'bpf':20B,107C 'call':120C 'caus':232C 'check':95C,254C,256C 'code':35B 'complet':130C 'config':224C 'consequ':167C 'cve':14A,17A 'defin':284C 'derefer':252C 'disabl':165C,264C 'earli':196C 'elimin':302C 'ensur':193C 'entri':204C,208C,248C,294C,297C 'everi':221C 'execut':140C,175C 'exit':195C 'extend':155C 'fast':304C 'fast-path':303C 'fgraph':203C,296C 'flight':127C 'follow':83C 'fprobe':3A,33B,88C,100C,103C,128C,134C,138C,187C,202C,206C,292C,295C,299C 'free':50B,74B,132C,184C 'freed':12A,189C 'ftrace':207C,293C 'full':154C 'fulli':272C 'function':237C 'furthermor':201C 'grace':115C,315C 'guarante':313C 'guard':90C,211C,287C 'handler':4A,37B,54B,129C,139C,194C 'held':261C 'hit':222C 'hold':262C 'host':27B 'howev':135C 'idl':9A,150C 'immedi':190C 'in-flight':125C 'interact':238C 'invok':218C 'kernel':2A,23B,31B,77B,81C 'kprobe':109C 'kprobe-multi':108C 'lead':178C 'linux':1A,22B,30B,80C 'linux-kernel':21B 'lock':216C,226C,259C,268C,308C 'lockdep':219C,233C,240C,310C 'long':277C 'lookup':243C 'loop':151C 'may':49B 'memori':13A 'multi':110C 'nohz':153C 'notrac':93C,270C,290C 'overhead':229C,311C 'path':305C 'period':116C,316C 'possibl':70B 'preemption':164C,263C 'preemption-dis':163C 'previous':209C 'probe':36B,48B,236C 'prove':225C 'quiescent':156C 'rcu':8A,41B,91C,96C,114C,118C,121C,142C,159C,169C,198C,212C,214C,249C,251C,257C,266C,279C,288C,306C 'read':215C,258C,267C,307C 'recurs':234C 'reli':111C 'resolv':87C 'return':300C 'rhl':245C 'rhltabl':242C 'run':6A,39B 'safe':314C 'sched':92C,269C,289C 'section':166C 'self':26B 'self-host':25B 'sinc':241C 'sourc':59B 'standard':113C,158C 'state':62B,157C 'still':55B 'suffici':275C 'synchron':117C,168C,317C 'trace':34B 'track':162C 'true':283C 'unregist':46B,99C,102C 'unregistr':192C 'use':11A,56B,72B,89C,105C,182C,210C,250C,286C 'use-after-fre':71B,181C 'valid':273C 'via':265C 'vulner':84C 'wait':123C,172C 'watch':44B,98C,145C,200C,281C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with fprobe, including setups that use BPF kprobe-multi probes that get unregistered at runtime, are the likely exposure. The sources do not say which kernel versions are affected or which configurations use fprobe by default. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:40+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98861","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98861","severity":null,"published_at":"2026-10-18T16:17:40+00:00","modified_at":"2026-10-19T10:19:50+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}