CVE-2026-98036

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Preserve special fields in recycled rhtab elements

rhtab_map_update_elem() initializes special fields after obtaining an

element from bpf_mem_cache_alloc(). The allocator can return a fresh,

zeroed unit, or recycle one from its RCU-pending lists before the

registered destructor has run.

A BPF program can retain a map-value pointer after deleting its element

and initialize and arm a timer through that pointer. If the deleted unit

is recycled, check_and_init_map_value() clears the only pointer to the

timer. Neither a later deletion nor rhtab_mem_dtor() can then cancel it,

and the callback can run with its key and value pointing into freed memory.

Do not reinitialize special fields on insertion. Fresh allocator units are

already zeroed. For recycled units, the special fields are ownership state

that must remain visible to the eventual destructor. copy_map_value()

already skips those fields, matching the non-preal

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References