CVE-2026-98035
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf: Cancel special fields when recycling rhtab elements
rhtab_map_update_existing() and rhtab_delete_elem() call bpf_obj_free_fields() when replacing or deleting a value. These map operations can run from BPF programs in NMI context, where releasing a referenced kptr or another complex field is not generally safe.
Array and hash maps avoid that problem by cancelling only the asynchronous fields which can be stopped safely in the caller context. Other ownership state remains attached to the allocation until its memory allocator destructor performs the final cleanup.
Use bpf_obj_cancel_fields() for the corresponding rhtab paths as well. This cancels timers, workqueues, and task work while allowing rhtab_mem_dtor() to release referenced kptrs when the allocation is eventually destroyed.
[ kkd: Rebased, used direct helper calls, and rewrote the commit log ]
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The Linux kernel contains a vulnerability within the BPF subsystem related to the handling of reference-counted pointers in rhashtable-based maps. Specifically, the functions bpf_obj_free_fields() were being invoked during map update and delete operations for rhtab elements. These operations can be executed from Non-Maskable Interrupt (NMI) context when triggered by BPF programs running under such constraints. In NMI contexts, it is generally unsafe to release complex fields or reference-counted kernel pointers because the necessary synchronization primitives may not be available or safe to use in that interrupt level. This improper handling creates a risk of race conditions and potential memory corruption if the referenced objects are freed while still being accessed by other parts of the system operating outside the NMI context.
The root cause lies in the inconsistency between how rhtab maps handle field cleanup compared to standard array and hash maps. Standard map implementations avoid this issue by canceling only asynchronous fields that can be safely stopped within the caller's context, while leaving ownership states attached to the allocation until its memory allocator destructor performs final cleanup. The vulnerability arises because rhtab paths were not following this safer pattern, instead attempting immediate free operations on complex fields like timers and workqueues directly during deletion or update events. This approach fails to account for the constraints imposed by NMI execution environments where sleeping functions or certain synchronization mechanisms are prohibited.
To resolve this issue, the fix replaces bpf_obj_free_fields() with bpf_obj_cancel_fields() in the relevant rhtab code paths. The new function safely cancels timers, workqueues, and task works without attempting to immediately free associated resources that require more complex cleanup procedures. This ensures that referenced kernel pointers remain valid until the allocation is eventually destroyed by its dedicated destructor routine, which operates in a context where such operations are safe. By deferring the actual release of reference-counted objects to the memory allocator's destruction phase, the patch eliminates the possibility of use-after-free scenarios and other concurrency-related bugs associated with premature resource reclamation.
From a security perspective, this vulnerability aligns with CWE-416 Use After Free, as improper timing in object deallocation can lead to accessing freed memory. It also relates to CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization due to the risks inherent in handling shared resources within interrupt contexts without proper locking or deferred cleanup mechanisms. In terms of MITRE ATT&CK mapping, this type of kernel-level vulnerability could potentially be leveraged for privilege escalation if an attacker can trigger these specific BPF map operations from NMI context, although exploitation would require precise timing and control over the affected system state.
Mitigation strategies involve applying the provided kernel patch to ensure that rhtab maps utilize safe cancellation practices rather than immediate freeing of complex fields. System administrators should monitor for updates to the Linux kernel that include this fix, particularly in environments where BPF programs are actively used with rhashtable-based data structures. Additionally, developers writing custom BPF code should be aware of execution context constraints and avoid relying on assumptions about when resources will be released during map operations. Regular security audits focusing on BPF program behavior and memory management practices can help identify similar issues in other parts of the kernel or third-party modules that interact with these subsystems.