Vulnerability-Lookup

GHSA-8234-QCRX-H2V8

Vulnerability from github – Published: 2026-10-18 18:32 – Updated: 2026-10-18 18:32

Details

In the Linux kernel, the following vulnerability has been resolved:

bpf: Hold map BTF for the memory allocator destructor record

bpf_ma_set_dtor() duplicates map->record so that the bpf_mem_alloc destructor can release the special fields of hash and rhash map elements once the allocator frees them for good. btf_record_dup() only acquires references on kernel and module BTF. Fields whose types live in the map BTF keep pointing into it: a kptr to a local type refers to map->btf, and a list_head or rb_root field carries a value_rec owned by the struct meta table of map->btf.

That borrowed state can outlive the map. When RCU callbacks are still in flight, bpf_mem_alloc_destroy() copies the allocator and defers the final drain, together with the destructor context, to a workqueue. bpf_map_free() then frees map->record and drops the map's BTF reference as soon as map_free() returns. Once the program that loaded the BTF is gone as well, the BTF is freed while the worker still uses the duplicate. The worker dereferences it through btf_is_kernel() and btf_find_struct_meta() in bpf_obj_free_fields() when destroying elements that were freed under RCU, and through btf_is_kernel() in btf_record_free() when releasing the context itself:

BUG: KASAN: slab-use-after-free in btf_is_kernel+0x19/0x30 Read of size 1 at addr ffff88811505dce8 by task kworker/u16:2/50 Workqueue: events_unbound free_mem_alloc_deferred Call Trace: btf_is_kernel+0x19/0x30 btf_record_free+0xc7/0xf0 htab_dtor_ctx_free+0x1a/0x30 free_mem_alloc_no_barrier+0x39/0x230 free_mem_alloc_deferred+0x2a/0x40 process_scheduled_works+0x5ce/0x9d0 worker_thread+0x42a/0x5e0 kthread+0x1f5/0x230 ret_from_fork+0x1dd/0x390 ret_from_fork_asm+0x1a/0x30

Allocated by task 358: __kmalloc_cache_noprof+0x287/0x510 btf_new_fd+0xf7/0x3d0 __sys_bpf+0x487/0x840

Freed by task 0: kfree+0x186/0x560 rcu_core+0x6f6/0xd40

Freeing a map that still holds more elements than the allocator's high watermark is enough to get there, because the bulk free during teardown queues the RCU callback that makes bpf_mem_alloc_destroy() defer. Non-preallocated hash maps and resizable hash maps both register the destructor and are affected alike.

Keep one reference on the map BTF in the destructor context. Every non-kernel pointer in the duplicated record is either map->btf or memory owned by it, so a single reference covers kptrs, list heads, and rb roots, and mirrors what bpf_map_meta_alloc() does for the duplicated record of an inner map. Release it only after the duplicated record has been freed: the worker is preemptible and not in an RCU read-side critical section, so dropping the last reference first would let the BTF be freed while btf_record_free() still reads its fields.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-98813"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-18T16:17:35Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Hold map BTF for the memory allocator destructor record\n\nbpf_ma_set_dtor() duplicates map-\u003erecord so that the bpf_mem_alloc\ndestructor can release the special fields of hash and rhash map elements\nonce the allocator frees them for good. btf_record_dup() only acquires\nreferences on kernel and module BTF. Fields whose types live in the map\nBTF keep pointing into it: a kptr to a local type refers to map-\u003ebtf,\nand a list_head or rb_root field carries a value_rec owned by the struct\nmeta table of map-\u003ebtf.\n\nThat borrowed state can outlive the map. When RCU callbacks are still in\nflight, bpf_mem_alloc_destroy() copies the allocator and defers the final\ndrain, together with the destructor context, to a workqueue.\nbpf_map_free() then frees map-\u003erecord and drops the map\u0027s BTF reference\nas soon as map_free() returns. Once the program that loaded the BTF is\ngone as well, the BTF is freed while the worker still uses the\nduplicate. The worker dereferences it through btf_is_kernel() and\nbtf_find_struct_meta() in bpf_obj_free_fields() when destroying elements\nthat were freed under RCU, and through btf_is_kernel() in\nbtf_record_free() when releasing the context itself:\n\n  BUG: KASAN: slab-use-after-free in btf_is_kernel+0x19/0x30\n  Read of size 1 at addr ffff88811505dce8 by task kworker/u16:2/50\n  Workqueue: events_unbound free_mem_alloc_deferred\n  Call Trace:\n   btf_is_kernel+0x19/0x30\n   btf_record_free+0xc7/0xf0\n   htab_dtor_ctx_free+0x1a/0x30\n   free_mem_alloc_no_barrier+0x39/0x230\n   free_mem_alloc_deferred+0x2a/0x40\n   process_scheduled_works+0x5ce/0x9d0\n   worker_thread+0x42a/0x5e0\n   kthread+0x1f5/0x230\n   ret_from_fork+0x1dd/0x390\n   ret_from_fork_asm+0x1a/0x30\n\n  Allocated by task 358:\n   __kmalloc_cache_noprof+0x287/0x510\n   btf_new_fd+0xf7/0x3d0\n   __sys_bpf+0x487/0x840\n\n  Freed by task 0:\n   kfree+0x186/0x560\n   rcu_core+0x6f6/0xd40\n\nFreeing a map that still holds more elements than the allocator\u0027s high\nwatermark is enough to get there, because the bulk free during teardown\nqueues the RCU callback that makes bpf_mem_alloc_destroy() defer.\nNon-preallocated hash maps and resizable hash maps both register the\ndestructor and are affected alike.\n\nKeep one reference on the map BTF in the destructor context. Every\nnon-kernel pointer in the duplicated record is either map-\u003ebtf or memory\nowned by it, so a single reference covers kptrs, list heads, and rb\nroots, and mirrors what bpf_map_meta_alloc() does for the duplicated\nrecord of an inner map. Release it only after the duplicated record has\nbeen freed: the worker is preemptible and not in an RCU read-side\ncritical section, so dropping the last reference first would let the\nBTF be freed while btf_record_free() still reads its fields.",
  "id": "GHSA-8234-qcrx-h2v8",
  "modified": "2026-10-18T18:32:04Z",
  "published": "2026-10-18T18:32:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98813"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ab39974240a0cff765f3bb9cce81d8001ffdb144"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b506f5699e145196ee29d76cf1ca1cbb2202c055"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2026-98813 (GCVE-0-2026-98813)

Vulnerability from cvelistv5 – Published: 2026-10-18 15:48 – Updated: 2026-10-19 09:26

Title

bpf: Hold map BTF for the memory allocator destructor record

Summary

In the Linux kernel, the following vulnerability has been resolved: bpf: Hold map BTF for the memory allocator destructor record bpf_ma_set_dtor() duplicates map->record so that the bpf_mem_alloc destructor can release the special fields of hash and rhash map elements once the allocator frees them for good. btf_record_dup() only acquires references on kernel and module BTF. Fields whose types live in the map BTF keep pointing into it: a kptr to a local type refers to map->btf, and a list_head or rb_root field carries a value_rec owned by the struct meta table of map->btf. That borrowed state can outlive the map. When RCU callbacks are still in flight, bpf_mem_alloc_destroy() copies the allocator and defers the final drain, together with the destructor context, to a workqueue. bpf_map_free() then frees map->record and drops the map's BTF reference as soon as map_free() returns. Once the program that loaded the BTF is gone as well, the BTF is freed while the worker still uses the duplicate. The worker dereferences it through btf_is_kernel() and btf_find_struct_meta() in bpf_obj_free_fields() when destroying elements that were freed under RCU, and through btf_is_kernel() in btf_record_free() when releasing the context itself: BUG: KASAN: slab-use-after-free in btf_is_kernel+0x19/0x30 Read of size 1 at addr ffff88811505dce8 by task kworker/u16:2/50 Workqueue: events_unbound free_mem_alloc_deferred Call Trace: btf_is_kernel+0x19/0x30 btf_record_free+0xc7/0xf0 htab_dtor_ctx_free+0x1a/0x30 free_mem_alloc_no_barrier+0x39/0x230 free_mem_alloc_deferred+0x2a/0x40 process_scheduled_works+0x5ce/0x9d0 worker_thread+0x42a/0x5e0 kthread+0x1f5/0x230 ret_from_fork+0x1dd/0x390 ret_from_fork_asm+0x1a/0x30 Allocated by task 358: __kmalloc_cache_noprof+0x287/0x510 btf_new_fd+0xf7/0x3d0 __sys_bpf+0x487/0x840 Freed by task 0: kfree+0x186/0x560 rcu_core+0x6f6/0xd40 Freeing a map that still holds more elements than the allocator's high watermark is enough to get there, because the bulk free during teardown queues the RCU callback that makes bpf_mem_alloc_destroy() defer. Non-preallocated hash maps and resizable hash maps both register the destructor and are affected alike. Keep one reference on the map BTF in the destructor context. Every non-kernel pointer in the duplicated record is either map->btf or memory owned by it, so a single reference covers kptrs, list heads, and rb roots, and mirrors what bpf_map_meta_alloc() does for the duplicated record of an inner map. Release it only after the duplicated record has been freed: the worker is preemptible and not in an RCU read-side critical section, so dropping the last reference first would let the BTF be freed while btf_record_free() still reads its fields.

Severity

No CVSS data available.

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6848 records in the last 180 days details

References

2 references

URL	Tags
https://git.kernel.org/stable/c/b506f5699e145196e…
https://git.kernel.org/stable/c/ab39974240a0cff76…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1df97a7453eec80c1912c2d0360290a3970a7671 , < b506f5699e145196ee29d76cf1ca1cbb2202c055 (git) Affected: 1df97a7453eec80c1912c2d0360290a3970a7671 , < ab39974240a0cff765f3bb9cce81d8001ffdb144 (git) Affected: 451a84a3ad3c897c03181af433e7c98640730f1f (git) Affected: 51a17f0ce19c4ee2a25cf16c93490d509b1ebb0a (git) Affected: 6.12.112 , < 6.13 (semver) Affected: 6.18.55 , < 6.19 (semver)
Linux	Linux	Affected: 7.0 Unaffected: 0 , < 7.0 (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/hashtab.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b506f5699e145196ee29d76cf1ca1cbb2202c055",
              "status": "affected",
              "version": "1df97a7453eec80c1912c2d0360290a3970a7671",
              "versionType": "git"
            },
            {
              "lessThan": "ab39974240a0cff765f3bb9cce81d8001ffdb144",
              "status": "affected",
              "version": "1df97a7453eec80c1912c2d0360290a3970a7671",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "451a84a3ad3c897c03181af433e7c98640730f1f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "51a17f0ce19c4ee2a25cf16c93490d509b1ebb0a",
              "versionType": "git"
            },
            {
              "lessThan": "6.13",
              "status": "affected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThan": "6.19",
              "status": "affected",
              "version": "6.18.55",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/hashtab.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.10",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.12.112",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.18.55",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Hold map BTF for the memory allocator destructor record\n\nbpf_ma_set_dtor() duplicates map-\u003erecord so that the bpf_mem_alloc\ndestructor can release the special fields of hash and rhash map elements\nonce the allocator frees them for good. btf_record_dup() only acquires\nreferences on kernel and module BTF. Fields whose types live in the map\nBTF keep pointing into it: a kptr to a local type refers to map-\u003ebtf,\nand a list_head or rb_root field carries a value_rec owned by the struct\nmeta table of map-\u003ebtf.\n\nThat borrowed state can outlive the map. When RCU callbacks are still in\nflight, bpf_mem_alloc_destroy() copies the allocator and defers the final\ndrain, together with the destructor context, to a workqueue.\nbpf_map_free() then frees map-\u003erecord and drops the map\u0027s BTF reference\nas soon as map_free() returns. Once the program that loaded the BTF is\ngone as well, the BTF is freed while the worker still uses the\nduplicate. The worker dereferences it through btf_is_kernel() and\nbtf_find_struct_meta() in bpf_obj_free_fields() when destroying elements\nthat were freed under RCU, and through btf_is_kernel() in\nbtf_record_free() when releasing the context itself:\n\n  BUG: KASAN: slab-use-after-free in btf_is_kernel+0x19/0x30\n  Read of size 1 at addr ffff88811505dce8 by task kworker/u16:2/50\n  Workqueue: events_unbound free_mem_alloc_deferred\n  Call Trace:\n   btf_is_kernel+0x19/0x30\n   btf_record_free+0xc7/0xf0\n   htab_dtor_ctx_free+0x1a/0x30\n   free_mem_alloc_no_barrier+0x39/0x230\n   free_mem_alloc_deferred+0x2a/0x40\n   process_scheduled_works+0x5ce/0x9d0\n   worker_thread+0x42a/0x5e0\n   kthread+0x1f5/0x230\n   ret_from_fork+0x1dd/0x390\n   ret_from_fork_asm+0x1a/0x30\n\n  Allocated by task 358:\n   __kmalloc_cache_noprof+0x287/0x510\n   btf_new_fd+0xf7/0x3d0\n   __sys_bpf+0x487/0x840\n\n  Freed by task 0:\n   kfree+0x186/0x560\n   rcu_core+0x6f6/0xd40\n\nFreeing a map that still holds more elements than the allocator\u0027s high\nwatermark is enough to get there, because the bulk free during teardown\nqueues the RCU callback that makes bpf_mem_alloc_destroy() defer.\nNon-preallocated hash maps and resizable hash maps both register the\ndestructor and are affected alike.\n\nKeep one reference on the map BTF in the destructor context. Every\nnon-kernel pointer in the duplicated record is either map-\u003ebtf or memory\nowned by it, so a single reference covers kptrs, list heads, and rb\nroots, and mirrors what bpf_map_meta_alloc() does for the duplicated\nrecord of an inner map. Release it only after the duplicated record has\nbeen freed: the worker is preemptible and not in an RCU read-side\ncritical section, so dropping the last reference first would let the\nBTF be freed while btf_record_free() still reads its fields."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:26:06.490Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b506f5699e145196ee29d76cf1ca1cbb2202c055"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab39974240a0cff765f3bb9cce81d8001ffdb144"
        }
      ],
      "title": "bpf: Hold map BTF for the memory allocator destructor record",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98813",
    "datePublished": "2026-10-18T15:48:59.745Z",
    "dateReserved": "2026-09-25T10:25:14.371Z",
    "dateUpdated": "2026-10-19T09:26:06.490Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted