CVE-2026-98813 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf: Hold map BTF for the memory allocator destructor record
bpf_ma_set_dtor() duplicates map->record so that the bpf_mem_alloc destructor can release the special fields of hash and rhash map elements once the allocator frees them for good. btf_record_dup() only acquires references on kernel and module BTF. Fields whose types live in the map BTF keep pointing into it: a kptr to a local type refers to map->btf, and a list_head or rb_root field carries a value_rec owned by the struct meta table of map->btf.
That borrowed state can outlive the map. When RCU callbacks are still in flight, bpf_mem_alloc_destroy() copies the allocator and defers the final drain, together with the destructor context, to a workqueue. bpf_map_free() then frees map->record and drops the map's BTF reference as soon as map_free() returns. Once the program that loaded the BTF is gone as well, the BTF is freed while the worker still uses the duplicate. The worker dereferences it through btf_is_kernel() and btf_find_struct_meta() in bpf_obj_free_fields() when destroying elements that were freed under RCU, and through btf_is_kernel() in btf_record_free() when releasing the context itself:
BUG: KASAN: slab-use-after-free in btf_is_kernel+0x19/0x30 Read of size 1 at addr ffff88811505dce8 by task kworker/u16:2/50 Workqueue: events_unbound free_mem_alloc_deferred Call Trace: btf_is_kernel+0x19/0x30 btf_record_free+0xc7/0xf0 htab_dtor_ctx_free+0x1a/0x30 free_mem_alloc_no_barrier+0x39/0x230 free_mem_alloc_deferred+0x2a/0x40 process_scheduled_works+0x5ce/0x9d0 worker_thread+0x42a/0x5e0 kthread+0x1f5/0x230 ret_from_fork+0x1dd/0x390 ret_from_fork_asm+0x1a/0x30
Allocated by task 358: __kmalloc_cache_noprof+0x287/0x510 btf_new_fd+0xf7/0x3d0 __sys_bpf+0x487/0x840
Freed by task 0: kfree+0x186/0x560 rcu_core+0x6f6/0xd40
Freeing a map that still holds more elements than the allocator's high watermark is enough to get there, because the bulk free during teardown queues the RCU callback that makes bpf_mem_alloc_destroy() defer. Non-preallocated hash maps and resizable hash maps both register the destructor and are affected alike.
Keep one reference on the map BTF in the destructor context. Every non-kernel pointer in the duplicated record is either map->btf or memory owned by it, so a single reference covers kptrs, list heads, and rb roots, and mirrors what bpf_map_meta_alloc() does for the duplicated record of an inner map. Release it only after the duplicated record has been freed: the worker is preemptible and not in an RCU read-side critical section, so dropping the last reference first would let the BTF be freed while btf_record_free() still reads its fields.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel contains a use-after-free vulnerability within the eBPF memory allocator subsystem that arises from improper lifecycle management of BTF metadata associated with hash and resizable hash maps. The core issue stems from how map records are duplicated for destruction purposes. When an eBPF map is destroyed, specifically through bpf_ma_set_dtor(), the system duplicates the map's record to allow the bpf_mem_alloc destructor to properly release special fields such as kptrs, list heads, and rb roots once the allocator frees these elements. However, while this duplication process correctly acquires references on kernel and module BTF data, it fails to secure a reference for types that reside within the map's own BTF blob. Consequently, pointers to local types in the duplicated record continue to point directly into the original map->btf structure rather than holding an independent reference count.
This architectural oversight creates a critical race condition during the teardown phase of maps with pending RCU callbacks. When a map is freed while it still holds more elements than the allocator's high watermark, the bulk free operation queues an RCU callback that triggers bpf_mem_alloc_destroy(). This function defers the final drain and destructor context to a workqueue for asynchronous processing via events_unbound. Simultaneously, the main execution path proceeds to call bpf_map_free(), which immediately frees map->record and drops the reference count on the map's BTF blob as soon as map_free() returns. If no other programs are holding references to that specific BTF ID, the kernel will free the BTF data structure entirely while the deferred worker thread is still scheduled to run but has not yet executed its cleanup logic.
The vulnerability manifests when the delayed work item eventually executes on a different CPU core or at a later time. The worker attempts to dereference the now-freed BTF metadata through functions like btf_is_kernel() and btf_find_struct_meta() within bpf_obj_free_fields(), as well as during the release of the context itself in btf_record_free(). Because the underlying memory has been reclaimed, these accesses result in a slab-use-after-free error. This is typically detected by Kernel Address Sanitizer (KASAN) as an invalid read operation on freed kernel memory, potentially leading to system instability, information disclosure if the freed memory was reallocated for sensitive data, or a denial of service through a kernel panic.
From a classification perspective, this flaw aligns with CWE-416: Use After Free, where program execution continues after memory has been deallocated, and CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization, as the race condition involves asynchronous workqueues interacting with shared metadata lifecycles. In terms of MITRE ATT&CK for Linux, this vulnerability could be leveraged in techniques related to Defense Evasion or Privilege Escalation if an attacker can trigger the specific map teardown conditions and exploit the resulting memory corruption to execute arbitrary code or crash the system.
The resolution involves modifying the destructor context logic to explicitly hold a reference on the map BTF blob for as long as the duplicated record exists in the workqueue. Since every non-kernel pointer in the duplicated record either points to map->btf or memory owned by it, maintaining this single additional reference ensures that the BTF data remains valid throughout the asynchronous destruction process. The reference is only released after the duplicated record has been safely freed and processed. This approach mirrors the existing logic used for inner maps via bpf_map_meta_alloc() and guarantees that the worker thread never dereferences invalid memory addresses, thereby eliminating the race condition between RCU callback deferral and BTF deallocation.