CVE-2026-98060 bpf: Reject resilient lock operations in rbtree callbacks
A use-after-free vulnerability in the Linux kernel BPF subsystem allows local attackers to execute arbitrary code or escalate privileges via rbtree callbacks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98060?
CVE-2026-98060 is an use after free vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject resilient lock operations in rbtree callbacks
__bpf_rbtree_add() keeps parent and link pointers live across calls to the program-supplied comparison callback. The verifier therefore requires the root's lock to remain held throughout the callback.
The helper path enforces this rule for bpf_spin_lock() and bpf_spin_unlock(), but the resilient lock kfunc argument path does not. Since resilient locks may protect BPF rbtree roots, a callback can release the root lock and let another CPU remove and free the node referenced by the in-progress tree walk. The walk then resumes using freed pointers.
Reject resilient lock kfuncs in an rbtree comparison callback, matching the existing policy for the spin lock helpers. Resilient-lock-protected trees remain valid when their comparison callbacks leave lock state alone.
Which versions are affected by CVE-2026-98060?
How do I fix CVE-2026-98060?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-98060 being exploited?
There is no known exploitation of CVE-2026-98060 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-98060, DEBIAN-CVE-2026-98060, GHSA-5qvg-w7qr-xhvh, UBUNTU-CVE-2026-98060.