FKIE_CVE-2026-98799

Vulnerability from fkie_nvd - Published: 2026-10-18 16:17 - Updated: 2026-10-19 10:19
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Skip detached progs in trampoline images that are still in use bpf_tramp_image_put() makes sure a trampoline image is not freed while a task may still be running in it, but nothing similar is done for the progs called by that image. Detach drops the last prog reference right away and the prog is freed after grace periods, on the basis that a task still in the traced function skips the fexit progs once the nop at ip_after_call is patched to a jump. That leaves out a task sleeping in a sleepable prog that runs before the detached one, which no grace period waits for: CPU 0 CPU 1 in image I, sleeping in prog S detach P from I's trampoline -> new image, bpf_tramp_image_put(I) bpf_prog_put(P), last ref grace periods, P freed back from S __bpf_prog_enter(P) call P->bpf_func If S and P are fexit progs the task is already past the patched jump, and fentry only images don't have one. On x86 this is an int3 in poisoned bpf_prog_pack memory: Oops: int3: 0000 [#1] SMP NOPTI CPU: 18 UID: 0 PID: 94573 Comm: x169 Not tainted 6.18.44 #1 PREEMPT(lazy) RIP: 0010:0xffffffffc0601d8d Call Trace: <TASK> ? bpf_trampoline_6442515411+0x1a4/0x21b bpf_lsm_bprm_committed_creds+0x5/0x10 security_bprm_committed_creds+0x5f/0x70 begin_new_exec+0x2d6/0x410 ... We hit this in production when progs attached through trampolines got detached while their hooks were busy, and it was independently found with a fuzzer and KASAN. Have the JITs emit a patchable nop in front of each prog call sequence and record it in the image. When a prog is detached, patch its nop to a jump over the call sequence. Progs that stay attached keep running for the tasks that are in the image, and ip_after_call isn't needed anymore. The task can be in any image that isn't freed yet, not only in the current one. It sleeps in image I1 that calls S, P and Q, then P is detached and the trampoline moves to image I2, then Q is detached and its call is still in I1. So the trampoline keeps a list of its images until they are freed, and detaching a prog patches its nop in all of them. Images hold a reference on the trampoline for that long. On riscv and loongarch a jump of any range takes several instructions, and a task preempted in the middle of them could resume into half of the new sequence. The nop is a single instruction there, patched to a near branch through arch_bpf_trampoline_skip(). With the extra nops, BPF_MAX_TRAMP_LINKS progs no longer fit in a page on x86 and arm64 (and already didn't on powerpc), so lower the limit there like s390 does.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/17637e1a581a22466ac3620a91e099683ff9cc6f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/967566ad325b42150483e81acb09ea9d800c00b8
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/net/bpf_jit_comp.c",
            "arch/loongarch/net/bpf_jit.c",
            "arch/powerpc/net/bpf_jit_comp.c",
            "arch/riscv/net/bpf_jit_comp64.c",
            "arch/s390/net/bpf_jit_comp.c",
            "arch/x86/net/bpf_jit_comp.c",
            "include/linux/bpf.h",
            "kernel/bpf/trampoline.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "967566ad325b42150483e81acb09ea9d800c00b8",
              "status": "affected",
              "version": "e21aa341785c679dd409c8cb71f864c00fe6c463",
              "versionType": "git"
            },
            {
              "lessThan": "17637e1a581a22466ac3620a91e099683ff9cc6f",
              "status": "affected",
              "version": "e21aa341785c679dd409c8cb71f864c00fe6c463",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e21d2b92354b3cd25dd774ebb0f0e52ff04a7861",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "85d177f56e5256e14b74a65940f981f6e3e8bb32",
              "versionType": "git"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.28",
              "versionType": "semver"
            },
            {
              "lessThan": "5.12",
              "status": "affected",
              "version": "5.11.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/net/bpf_jit_comp.c",
            "arch/loongarch/net/bpf_jit.c",
            "arch/powerpc/net/bpf_jit_comp.c",
            "arch/riscv/net/bpf_jit_comp64.c",
            "arch/s390/net/bpf_jit_comp.c",
            "arch/x86/net/bpf_jit_comp.c",
            "include/linux/bpf.h",
            "kernel/bpf/trampoline.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Skip detached progs in trampoline images that are still in use\n\nbpf_tramp_image_put() makes sure a trampoline image is not freed while\na task may still be running in it, but nothing similar is done for the\nprogs called by that image. Detach drops the last prog reference right\naway and the prog is freed after grace periods, on the basis that a\ntask still in the traced function skips the fexit progs once the nop at\nip_after_call is patched to a jump.\n\nThat leaves out a task sleeping in a sleepable prog that runs before\nthe detached one, which no grace period waits for:\n\n  CPU 0                               CPU 1\n  in image I, sleeping in prog S\n                                      detach P from I\u0027s trampoline\n                                       -\u003e new image, bpf_tramp_image_put(I)\n                                      bpf_prog_put(P), last ref\n                                      grace periods, P freed\n  back from S\n  __bpf_prog_enter(P)\n  call P-\u003ebpf_func\n\nIf S and P are fexit progs the task is already past the patched jump,\nand fentry only images don\u0027t have one. On x86 this is an int3 in\npoisoned bpf_prog_pack memory:\n\n  Oops: int3: 0000 [#1] SMP NOPTI\n  CPU: 18 UID: 0 PID: 94573 Comm: x169 Not tainted 6.18.44 #1 PREEMPT(lazy)\n  RIP: 0010:0xffffffffc0601d8d\n  Call Trace:\n   \u003cTASK\u003e\n   ? bpf_trampoline_6442515411+0x1a4/0x21b\n   bpf_lsm_bprm_committed_creds+0x5/0x10\n   security_bprm_committed_creds+0x5f/0x70\n   begin_new_exec+0x2d6/0x410\n   ...\n\nWe hit this in production when progs attached through trampolines got\ndetached while their hooks were busy, and it was independently found\nwith a fuzzer and KASAN.\n\nHave the JITs emit a patchable nop in front of each prog call sequence\nand record it in the image. When a prog is detached, patch its nop to a\njump over the call sequence. Progs that stay attached keep running for\nthe tasks that are in the image, and ip_after_call isn\u0027t needed anymore.\n\nThe task can be in any image that isn\u0027t freed yet, not only in the\ncurrent one. It sleeps in image I1 that calls S, P and Q, then P is\ndetached and the trampoline moves to image I2, then Q is detached and\nits call is still in I1. So the trampoline keeps a list of its images\nuntil they are freed, and detaching a prog patches its nop in all of\nthem. Images hold a reference on the trampoline for that long.\n\nOn riscv and loongarch a jump of any range takes several instructions,\nand a task preempted in the middle of them could resume into half of the\nnew sequence. The nop is a single instruction there, patched to a near\nbranch through arch_bpf_trampoline_skip().\n\nWith the extra nops, BPF_MAX_TRAMP_LINKS progs no longer fit in a page\non x86 and arm64 (and already didn\u0027t on powerpc), so lower the limit\nthere like s390 does."
    }
  ],
  "id": "CVE-2026-98799",
  "lastModified": "2026-10-19T10:19:43.933",
  "metrics": {},
  "published": "2026-10-18T16:17:33.910",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/17637e1a581a22466ac3620a91e099683ff9cc6f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/967566ad325b42150483e81acb09ea9d800c00b8"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.