CVE-2026-98036 bpf: Preserve special fields in recycled rhtab elements
A use-after-free in the Linux kernel BPF subsystem allows local attackers to execute arbitrary code or escalate privileges via recycled hash table elements.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98036?
CVE-2026-98036 is an use after free vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Preserve special fields in recycled rhtab elements
rhtab_map_update_elem() initializes special fields after obtaining an element from bpf_mem_cache_alloc(). The allocator can return a fresh, zeroed unit, or recycle one from its RCU-pending lists before the registered destructor has run.
A BPF program can retain a map-value pointer after deleting its element and initialize and arm a timer through that pointer. If the deleted unit is recycled, check_and_init_map_value() clears the only pointer to the timer. Neither a later deletion nor rhtab_mem_dtor() can then cancel it, and the callback can run with its key and value pointing into freed memory.
Do not reinitialize special fields on insertion. Fresh allocator units are already zeroed. For recycled units, the special fields are ownership state that must remain visible to the eventual destructor. copy_map_value() already skips those fields, matching the non-preallocated hash-map path and the lifecycle established by commit 275c30bcee66 ("bpf: Don't reinit map value in prealloc_lru_pop").
[ kkd: Split out the fix and rewrote the commit log ]
Which versions are affected by CVE-2026-98036?
How do I fix CVE-2026-98036?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-98036 being exploited?
There is no known exploitation of CVE-2026-98036 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-98036, GHSA-3w55-5pcm-xp58, UBUNTU-CVE-2026-98036.