CVE-2026-98378
UnknownSummary
In the Linux kernel, a vulnerability exists in the BPF link iterator. bpf_link_prime() inserts a link into link_idr before the ID is published, and the link iterator takes a reference without checking whether the link is settled (ID zero). If anon_inode_getfile() fails, the iterator is left with a dangling reference and a subsequent bpf_link_put() accesses freed memory (use-after-free).
Risk Assessment
A use-after-free in the kernel can lead to a kernel panic (DoS) or potentially privilege escalation by a local attacker able to load BPF programs.
Recommendation
Update the Linux kernel to a version containing the fix that treats ID-zero entries as transient in bpf_link_get_curr_or_next(). If updating is not possible, restrict BPF program loading to trusted users.
Other vulnerabilities in Linux kernel
See all- CVE-2026-98384Unknown
In the Linux kernel, bpf_sock_destroy() reads sk_protocol from the wrong structure, causing an out-of-bounds read. The issue affects TIME_WAIT and request sockets passed by the TCP iterator. The fix restricts the sk_protocol check to full sockets only.
- CVE-2026-98383Unknown
In the Linux kernel, LWT_SEG6LOCAL programs can invalidate the cached SRH and then call bpf_skb_pull_data(), leading to a dangling pointer and use-after-free. The fix disallows bpf_skb_pull_data() for LWT_SEG6LOCAL programs.
- CVE-2026-98382Unknown
In the Linux kernel, the BPF device matching mechanism has a flaw that allows a program bound to one device to run on another, leading to memory corruption. The fix restricts non-offloaded programs to exact netdev matches.
- CVE-2026-98381Unknown
In the Linux kernel, during veth channel resize, XDP program pointers are not cleared for removed RX queues. This can lead to running a freed program after a later channel increase, causing a system crash.
- CVE-2026-98380Unknown
In the Linux kernel's net/sched subsystem, a vulnerability exists where tcf_action_delete() fails to check if the IDR lookup result is an error pointer (ERR_PTR). An attacker can exploit a race to replace an action with an error pointer, leading to a null-pointer dereference and kernel panic.
- CVE-2026-98379Unknown
A vulnerability in the Linux kernel's netfilter ip6t_rpfilter module was found, where ip6_route_lookup() can return a route without an inet6_dev (NULL pointer). An unprivileged user can trigger this state by lowering an external interface's MTU below IPV6_MIN_MTU, leading to a NULL pointer dereference and kernel panic.
- CVE-2026-98377Unknown
In the Linux kernel, __vlan_insert_inner_tag() does not require the MAC header to be present before rewriting it. When a very short frame is sent through an IFF_TUN device, subsequent VLAN push operations can pull uninitialized slab bytes into the frame, leaking kernel memory.
- CVE-2026-98376Unknown
In the Linux kernel, the metadata comparison for percpu array BPF maps used as inner maps does not check max_entries. Replacing an inner map with a smaller one bypasses validation, and the index_mask inlined by the JIT can cause an out-of-bounds access to the pptrs[] array.
- CVE-2026-98375Unknown
In the Linux kernel, the xen/netfront driver does not validate the length of the first RX slot against ETH_HLEN before calling eth_type_trans(). If the first slot is shorter than an Ethernet header, a BUG() may occur in __skb_pull() or the header may be read past the end of the data.
- CVE-2026-98374Unknown
In the Linux kernel, a use-after-free vulnerability exists in tcp_send_synack() involving retransmit_skb_hint. When tcp_send_synack() replaces the cloned SYN skb at the head of the retransmit queue with a copy, it frees the original but tp->retransmit_skb_hint still points to the freed object, which can be exploited by an unprivileged TFO client to trigger a use-after-free.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: bpf: Skip unsettled links in link iterator bpf_link_prime() inserts a link into link_idr before anon_inode_getfile() succeeds and before bpf_link_settle() publishes the ID in link->id. bpf_link_by_id() treats such an ID-zero link as unsettled, but the link iterator takes a reference without this check. If anon_inode_getfile() then fails, the creator removes the ID and frees its still-private link directly. The iterator is left with a dangling reference and its next bpf_link_put() accesses freed memory. Treat ID-zero entries as transient in bpf_link_get_curr_or_next(), just as bpf_link_by_id() does. BUG: KASAN: slab-use-after-free in bpf_link_put Write of size 8 by task exp/384 Call Trace: bpf_link_put kernel/bpf/syscall.c:3372 bpf_link_seq_next kernel/bpf/link_iter.c:33 bpf_seq_read kernel/bpf/bpf_iter.c:158 vfs_read fs/read_write.c:572 ksys_read fs/read_write.c:716 do_syscall_64 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe arch/x86/entry/entry_64.S:121 Kernel panic - not syncing: KASAN: panic_on_warn set ...
Vulnerability data from NVD (NIST) · CISA KEV · EPSS