{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-98813 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-98813 is an use after free vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-98813 and fix it if it is affected.\n\nWhat it is: CVE-2026-98813 is an use after free vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-98813 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-98813/ (Markdown: https://insights.sbomify.com/CVE-2026-98813/index.md)","id":"CVE-2026-98813","markdown":"https://insights.sbomify.com/CVE-2026-98813/index.md","name":"CVE-2026-98813","record":{"aliases":["BELL-CVE-2026-98813","DEBIAN-CVE-2026-98813","GHSA-8234-qcrx-h2v8","UBUNTU-CVE-2026-98813"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A use-after-free in the Linux kernel BPF memory allocator allows local attackers to execute arbitrary code or escalate privileges.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Hold map BTF for the memory allocator destructor record\n\nbpf_ma_set_dtor() duplicates map-\u003erecord so that the bpf_mem_alloc\ndestructor can release the special fields of hash and rhash map elements\nonce the allocator frees them for good. btf_record_dup() only acquires\nreferences on kernel and module BTF. Fields whose types live in the map\nBTF keep pointing into it: a kptr to a local type refers to map-\u003ebtf,\nand a list_head or rb_root field carries a value_rec owned by the struct\nmeta table of map-\u003ebtf.\n\nThat borrowed state can outlive the map. When RCU callbacks are still in\nflight, bpf_mem_alloc_destroy() copies the allocator and defers the final\ndrain, together with the destructor context, to a workqueue.\nbpf_map_free() then frees map-\u003erecord and drops the map's BTF reference\nas soon as map_free() returns. Once the program that loaded the BTF is\ngone as well, the BTF is freed while the worker still uses the\nduplicate. The worker dereferences it through btf_is_kernel() and\nbtf_find_struct_meta() in bpf_obj_free_fields() when destroying elements\nthat were freed under RCU, and through btf_is_kernel() in\nbtf_record_free() when releasing the context itself:\n\n  BUG: KASAN: slab-use-after-free in btf_is_kernel+0x19/0x30\n  Read of size 1 at addr ffff88811505dce8 by task kworker/u16:2/50\n  Workqueue: events_unbound free_mem_alloc_deferred\n  Call Trace:\n   btf_is_kernel+0x19/0x30\n   btf_record_free+0xc7/0xf0\n   htab_dtor_ctx_free+0x1a/0x30\n   free_mem_alloc_no_barrier+0x39/0x230\n   free_mem_alloc_deferred+0x2a/0x40\n   process_scheduled_works+0x5ce/0x9d0\n   worker_thread+0x42a/0x5e0\n   kthread+0x1f5/0x230\n   ret_from_fork+0x1dd/0x390\n   ret_from_fork_asm+0x1a/0x30\n\n  Allocated by task 358:\n   __kmalloc_cache_noprof+0x287/0x510\n   btf_new_fd+0xf7/0x3d0\n   __sys_bpf+0x487/0x840\n\n  Freed by task 0:\n   kfree+0x186/0x560\n   rcu_core+0x6f6/0xd40\n\nFreeing a map that still holds more elements than the allocator's high\nwatermark is enough to get there, because the bulk free during teardown\nqueues the RCU callback that makes bpf_mem_alloc_destroy() defer.\nNon-preallocated hash maps and resizable hash maps both register the\ndestructor and are affected alike.\n\nKeep one reference on the map BTF in the destructor context. Every\nnon-kernel pointer in the duplicated record is either map-\u003ebtf or memory\nowned by it, so a single reference covers kptrs, list heads, and rb\nroots, and mirrors what bpf_map_meta_alloc() does for the duplicated\nrecord of an inner map. Release it only after the duplicated record has\nbeen freed: the worker is preemptible and not in an RCU read-side\ncritical section, so dropping the last reference first would let the\nBTF be freed while btf_record_free() still reads its fields.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"bpf: Hold map BTF for the memory allocator destructor record","id":"CVE-2026-98813","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"nvme: fix command effects log lifetime for multipath heads","id":"CVE-2026-98814"},"packages":[],"prev":{"headline":"net/mctp: publish the mctp_dev only after it is initialised","id":"CVE-2026-98812"},"products":["Linux"],"published":"2026-10-18","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A use-after-free in the Linux kernel BPF memory allocator allows local attackers to execute arbitrary code or escalate privileges.","url":"https://insights.sbomify.com/CVE-2026-98813/"}