CVE-2026-98117 cachefiles: Fix potential UAF/KASAN warning
A use-after-free vulnerability in the Linux kernel cachefiles subsystem allows local attackers to cause a crash or potentially execute code via tracepoint handling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98117?
CVE-2026-98117 is a high-severity use after free vulnerability in Linux kernel, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
cachefiles: Fix potential UAF/KASAN warning
Currently, trace_cachefiles_coherency() is being passed a pointer to a __be64 lain over the coherency data in struct cachefiles_xattr so that it can display the first 8 bytes. However, the data is of variable length and could even be 0 bytes. This could lead to a UAF or KASAN warning.
Fix this by making sure the buffer has room for at least 8 bytes and that those 8 bytes are pre-cleared.
Further, those bytes are not 8-byte aligned, so fix the tracepoint to extract the data as four 2-byte words (they are 2-byte aligned) and reassemble the __be64. The compiler will convert this into a single 8-byte load where the CPU supports it.
Weakness: CWE-416
Which versions are affected by CVE-2026-98117?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-98117?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-98117 being exploited?
There is no known exploitation of CVE-2026-98117 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-98117, DEBIAN-CVE-2026-98117, GHSA-57px-gx57-6w68, UBUNTU-CVE-2026-98117.