CVE-2026-98378

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Skip unsettled links in link iterator

bpf_link_prime() inserts a link into link_idr before anon_inode_getfile()

succeeds and before bpf_link_settle() publishes the ID in link->id.

bpf_link_by_id() treats such an ID-zero link as unsettled, but the link

iterator takes a reference without this check.

If anon_inode_getfile() then fails, the creator removes the ID and frees

its still-private link directly. The iterator is left with a dangling

reference and its next bpf_link_put() accesses freed memory.

Treat ID-zero entries as transient in bpf_link_get_curr_or_next(), just as

bpf_link_by_id() does.

BUG: KASAN: slab-use-after-free in bpf_link_put

Write of size 8 by task exp/384

Call Trace:

bpf_link_put kernel/bpf/syscall.c:3372

bpf_link_seq_next kernel/bpf/link_iter.c:33

bpf_seq_read kernel/bpf/bpf_iter.c:158

vfs_read fs/read_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References