{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-98642 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-98642 is an use after free vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-98642 and fix it if it is affected.\n\nWhat it is: CVE-2026-98642 is an use after free vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-98642 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-98642/ (Markdown: https://insights.sbomify.com/CVE-2026-98642/index.md)","id":"CVE-2026-98642","markdown":"https://insights.sbomify.com/CVE-2026-98642/index.md","name":"CVE-2026-98642","record":{"aliases":["AZL-109311","BELL-CVE-2026-98642","DEBIAN-CVE-2026-98642","GHSA-9437-xj9f-2c6g","UBUNTU-CVE-2026-98642"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A race condition in the Linux kernel BPF memory allocator allows local attackers to trigger a use-after-free, potentially leading to code execution or privilege escalation.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk\n\nSyzkaller repeatedly triggered UAF splats related to nodes in\nwaiting_for_gp_ttrace within the bpf memalloc:\n\nBUG: KASAN: slab-use-after-free in llist_del_first+0x85/0x110 lib/llist.c:61\nRead of size 8 at addr ffff8881572cd080 by task syz.4.470/5112\n ...\n llist_del_first+0x85/0x110 lib/llist.c:61\n alloc_bulk+0x193/0x460 kernel/bpf/memalloc.c:229\n bpf_mem_refill+0x386/0x560 kernel/bpf/memalloc.c:436\n\nFreed by task 14:\n ...\n __free_rcu kernel/bpf/memalloc.c:281 [inline]\n __free_rcu_tasks_trace+0x48/0xd0 kernel/bpf/memalloc.c:291\n rcu_tasks_invoke_cbs+0x1ec/0x3e0 kernel/rcu/tasks.h:571\n rcu_tasks_one_gp+0x13d/0x220 kernel/rcu/tasks.h:621\n rcu_tasks_kthread+0xf3/0x120 kernel/rcu/tasks.h:651\n\nThe reason is that the UAF occurs after the RCU Tasks Trace GP expires:\nwhen the __free_rcu() callback runs, there is no synchronization\nprotecting llist_del_all() against concurrent alloc_bulk() operating on\nwaiting_for_gp_ttrace, leading to the race condition below:\n\nCPU0                                           CPU1\n                                               __free_rcu (RCU Tasks Trace callback)\nalloc_bulk\n  llist_del_first(\u0026c-\u003ewaiting_for_gp_ttrace)\n    entry = smp_load_acquire(\u0026head-\u003efirst);\n    do {\n      if (entry == NULL)\n        return NULL;\n                                               free_all(llist_del_all(\u0026c-\u003ewaiting_for_gp_ttrace))\n                                                 llist_for_each_safe(pos, t, llnode)\n                                                   free_one(pos);\n      next = READ_ONCE(entry-\u003enext); \u003c-- trigger UAF\n    } while (!try_cmpxchg(\u0026head-\u003efirst, \u0026entry, next));\n\nIn addition, there is also a theoretical race condition on the\nfree_by_rcu_ttrace list. This race requires two preconditions: an\nin-flight Tasks Trace GP keeping c-\u003ecall_rcu_ttrace_in_progress == 1,\nand concurrent cross-CPU frees repopulating c-\u003efree_by_rcu_ttrace with\nnew nodes. Under these conditions, the following scenario triggers UAF:\n\n// CPU0\n// irq work is still busy (on PREEMPT_RT)\nalloc_bulk()\n  llist_del_first(\u0026c-\u003efree_by_rcu_ttrace)\n    entry = smp_load_acquire(\u0026head-\u003efirst);\n    do {\n      if (entry == NULL)\n        return NULL;\n\n        // CPU1\n        bpf_mem_alloc_destroy()\n          WRITE_ONCE(c-\u003edraining, true)\n          // wait for CPU0\n          irq_work_sync()\n\n                // CPU2\n                do_call_rcu_ttrace(tgt(CPU0))\n                  if (c-\u003edraining) {\n                    llist_del_all(\u0026c-\u003efree_by_rcu_ttrace)\n                    free_all()\n                  }\n\n// CPU0 continue\n      next = READ_ONCE(entry-\u003enext); \u003c-- trigger UAF\n    while (!try_cmpxchg(\u0026head-\u003efirst, \u0026entry, next));\n\nFix this by introducing a raw spinlock to synchronize the concurrent\nconsumption on waiting_for_gp_ttrace and free_by_rcu_ttrace.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk","id":"CVE-2026-98642","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":4,"next":{"headline":"bpf: Fix out-of-bounds read of rtt_min in sock_ops","id":"CVE-2026-98643"},"packages":[],"prev":{"headline":"bpf, arm64: set up the frame pointer for the exception callback","id":"CVE-2026-98641"},"products":["Linux"],"published":"2026-10-18","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A race condition in the Linux kernel BPF memory allocator allows local attackers to trigger a use-after-free, potentially leading to code execution or privilege escalation.","url":"https://insights.sbomify.com/CVE-2026-98642/"}