CVE-2026-98060bpf: Reject resilient lock operations in rbtree callbacks
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject resilient lock operations in rbtree callbacks __bpf_rbtree_add() keeps parent and link pointers live across calls to the program-supplied comparison callback. The verifier therefore requires the root's lock to remain held throughout the callback. The helper path enforces this rule for bpf_spin_lock() and bpf_spin_unlock(), but the resilient lock kfunc argument path does not. Since resilient locks may protect BPF rbtree roots, a callback can release the root lock and let another CPU remove and free the node referenced by the in-progress tree walk. The walk then resumes using freed pointers. Reject resilient lock kfuncs in an rbtree comparison callback, matching the existing policy for the spin lock helpers. Resilient-lock-protected trees remain valid when their comparison callbacks leave lock state alone.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Undergoing Analysis
- Record last updated
- Sep 25, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 0de2046137f976e7302d43ac01d9894d07ac1fff before cc2e065ed206aecd9b94564779244f3ffb26e356; from 0de2046137f976e7302d43ac01d9894d07ac1fff before 71930202a0a0c49f0a3b45b41907a074cb780266; from 0de2046137f976e7302d43ac01d9894d07ac1fff before 7b7b8b5960102566bd625ae829d1f330c5b5d104 | CNA record |
References
- https://git.kernel.org/stable/c/cc2e065ed206aecd9b94564779244f3ffb26e356
- https://git.kernel.org/stable/c/71930202a0a0c49f0a3b45b41907a074cb780266
- https://git.kernel.org/stable/c/7b7b8b5960102566bd625ae829d1f330c5b5d104
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.