CVE-2026-98378 in Linux
Summary
by MITRE • 10/09/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf: Skip unsettled links in link iterator
bpf_link_prime() inserts a link into link_idr before anon_inode_getfile() succeeds and before bpf_link_settle() publishes the ID in link->id. bpf_link_by_id() treats such an ID-zero link as unsettled, but the link iterator takes a reference without this check.
If anon_inode_getfile() then fails, the creator removes the ID and frees its still-private link directly. The iterator is left with a dangling reference and its next bpf_link_put() accesses freed memory.
Treat ID-zero entries as transient in bpf_link_get_curr_or_next(), just as bpf_link_by_id() does.
BUG: KASAN: slab-use-after-free in bpf_link_put Write of size 8 by task exp/384 Call Trace: bpf_link_put kernel/bpf/syscall.c:3372 bpf_link_seq_next kernel/bpf/link_iter.c:33 bpf_seq_read kernel/bpf/bpf_iter.c:158 vfs_read fs/read_write.c:572 ksys_read fs/read_write.c:716 do_syscall_64 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe arch/x86/entry/entry_64.S:121 Kernel panic - not syncing: KASAN: panic_on_warn set ...
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/09/2026
The Linux kernel's Berkeley Packet Filter subsystem contains a critical race condition vulnerability within the link iterator mechanism, specifically affecting how transient BPF links are handled during their initialization phase. This flaw arises from an inconsistency in reference counting and state management between different components of the BPF infrastructure. When a new BPF link is created via bpf_link_prime(), the system inserts the link into the global identifier resource directory before the associated anonymous inode file descriptor is successfully allocated and before the link's internal ID is officially published through bpf_link_settle(). This sequence creates a window where the link exists in an unsettled state, characterized by having an ID of zero. While the function bpf_link_by_id() correctly identifies these ID-zero entries as transient and handles them appropriately to prevent premature access, the link iterator implementation fails to perform this same validation check. Consequently, when iterating through BPF links, the system may acquire a reference count for a link that has not yet been fully initialized or settled, leading to unsafe memory operations if the initialization process subsequently fails.
The operational impact of this vulnerability is severe, manifesting as a use-after-free condition that can lead to kernel panics and potential privilege escalation scenarios depending on the attacker's capabilities. If the anonymous inode allocation step within bpf_link_prime() fails for any reason, such as resource exhaustion or permission issues, the creator routine removes the identifier from the ID space and immediately frees the private link structure. However, because the iterator had already taken a reference to this object without verifying its settled status, it retains a dangling pointer to memory that has been returned to the slab allocator. When the iteration process proceeds to release this reference via bpf_link_put(), it attempts to write to or access freed kernel memory. This triggers a Kernel Address Sanitizer warning and can cause an immediate kernel panic if the system is configured with panic_on_warn enabled, effectively resulting in a denial of service against the host operating system.
From a technical perspective, this vulnerability aligns with CWE-416, Use After Free, as it involves accessing memory after it has been freed due to improper lifecycle management. The root cause lies in CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization, where the iterator and the link creation/teardown routines operate without sufficient synchronization regarding the unsettled state of BPF links. In terms of attack vectors, this flaw could be leveraged within an ATT&CK framework context under T1059, Command and Scripting Interpreter, or more specifically as part of a local privilege escalation chain where an unprivileged user triggers the race condition to crash the system or potentially exploit the memory corruption for code execution. The vulnerability highlights the complexity of managing object lifecycles in high-concurrency kernel subsystems like BPF, where rapid creation and destruction of objects are common patterns.
To mitigate this risk, the primary remediation is the application of the upstream Linux kernel patch that modifies bpf_link_get_curr_or_next() to treat ID-zero entries as transient, mirroring the logic already present in bpf_link_by_id(). This ensures that any link iterator operation checks for the settled state before acquiring a reference. System administrators and developers should prioritize updating their kernels to versions where this fix is included. For environments running older kernel versions, mitigating strategies include restricting access to BPF-related syscalls through mandatory access control policies such as SELinux or AppArmor, limiting which users can create BPF programs or links, and monitoring for unusual spikes in BPF link creation failures that might indicate exploitation attempts. Regular security audits of custom eBPF applications are also recommended to ensure they handle initialization errors gracefully without triggering these race conditions.