CVE-2026-98047 (GCVE-0-2026-98047)
Vulnerability from cvelistv5
Published
2026-09-25 10:23
Modified
2026-10-21 12:54
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Check ancestor frames for rbtree callbacks bpf_rbtree_add() invokes its comparator while the caller holds the root lock. The native insertion code retains raw parent and link pointers across the callback, so the verifier prohibits unlocking, consuming tree nodes, or changing RCU state from that callback. in_rbtree_lock_required_cb() only checks the innermost verifier frame. Static subprogram calls are permitted while holding a spin lock, and such a call pushes a frame without in_callback_fn set. Consequently, all callback restrictions disappear in the nested frame. The subprogram can unlock the tree, remove and drop the node being compared, then relock. Native insertion resumes with the stale parent pointer and links freed memory into the tree. Walk all active frames for the rbtree callback instead. Benign static subprograms remain permitted, while callback restrictions follow execution into nested frames.
References
Impacted products
Vendor Product Version
Linux Linux Version: a44b1334aadd82203f661adb9adb41e53ad0e8d1
Version: a44b1334aadd82203f661adb9adb41e53ad0e8d1
Version: a44b1334aadd82203f661adb9adb41e53ad0e8d1
Version: a44b1334aadd82203f661adb9adb41e53ad0e8d1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "252e9b476af723edd299a5c71c389ec018e46656",
              "status": "affected",
              "version": "a44b1334aadd82203f661adb9adb41e53ad0e8d1",
              "versionType": "git"
            },
            {
              "lessThan": "b545fa447e09e6844868deb2bee228827fe54d15",
              "status": "affected",
              "version": "a44b1334aadd82203f661adb9adb41e53ad0e8d1",
              "versionType": "git"
            },
            {
              "lessThan": "2410cb2ac0416dd2795a81984c8c73d7250bd8c4",
              "status": "affected",
              "version": "a44b1334aadd82203f661adb9adb41e53ad0e8d1",
              "versionType": "git"
            },
            {
              "lessThan": "369f4ce734570bdfedaa4b5ca50e2a3f6a892728",
              "status": "affected",
              "version": "a44b1334aadd82203f661adb9adb41e53ad0e8d1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.114",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check ancestor frames for rbtree callbacks\n\nbpf_rbtree_add() invokes its comparator while the caller holds the root\nlock. The native insertion code retains raw parent and link pointers across\nthe callback, so the verifier prohibits unlocking, consuming tree nodes,\nor changing RCU state from that callback.\n\nin_rbtree_lock_required_cb() only checks the innermost verifier frame.\nStatic subprogram calls are permitted while holding a spin lock, and such a\ncall pushes a frame without in_callback_fn set. Consequently, all callback\nrestrictions disappear in the nested frame. The subprogram can unlock the\ntree, remove and drop the node being compared, then relock. Native insertion\nresumes with the stale parent pointer and links freed memory into the tree.\n\nWalk all active frames for the rbtree callback instead. Benign static\nsubprograms remain permitted, while callback restrictions follow execution\ninto nested frames."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:54:13.942Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/252e9b476af723edd299a5c71c389ec018e46656"
        },
        {
          "url": "https://git.kernel.org/stable/c/b545fa447e09e6844868deb2bee228827fe54d15"
        },
        {
          "url": "https://git.kernel.org/stable/c/2410cb2ac0416dd2795a81984c8c73d7250bd8c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/369f4ce734570bdfedaa4b5ca50e2a3f6a892728"
        }
      ],
      "title": "bpf: Check ancestor frames for rbtree callbacks",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98047",
    "datePublished": "2026-09-25T10:23:57.347Z",
    "dateReserved": "2026-09-25T10:19:56.072Z",
    "dateUpdated": "2026-10-21T12:54:13.942Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.