CVE-2026-98813

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Hold map BTF for the memory allocator destructor record

bpf_ma_set_dtor() duplicates map->record so that the bpf_mem_alloc

destructor can release the special fields of hash and rhash map elements

once the allocator frees them for good. btf_record_dup() only acquires

references on kernel and module BTF. Fields whose types live in the map

BTF keep pointing into it: a kptr to a local type refers to map->btf,

and a list_head or rb_root field carries a value_rec owned by the struct

meta table of map->btf.

That borrowed state can outlive the map. When RCU callbacks are still in

flight, bpf_mem_alloc_destroy() copies the allocator and defers the final

drain, together with the destructor context, to a workqueue.

bpf_map_free() then frees map->record and drops the map's BTF reference

as soon as map_free() returns. Once the program that loaded the BTF is

gone as well, the BTF is freed while the worker still uses the

dupl

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References