{"id":41272,"date":"2026-10-19T00:32:56","date_gmt":"2026-10-18T16:32:56","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98800"},"modified":"2026-10-19T00:32:56","modified_gmt":"2026-10-18T16:32:56","slug":"cve-2026-98800","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98800","title":{"rendered":"CVE-2026-98800 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Wait for an RCU"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>bpf: Wait for an RCU tasks grace period before freeing trampoline progs<\/p>\n<p>When a prog is detached from a trampoline, it is freed after an RCU<br \/>\ngrace period, or an RCU tasks trace one if it is sleepable. This covers<br \/>\nthe tasks that are running the prog, since the prog&#8217;s enter helper takes<br \/>\nthe matching read lock before the prog is called. On a preemptible<br \/>\nkernel, it doesn&#8217;t cover a task that was preempted in the trampoline<br \/>\njust before the enter helper. That task holds no lock yet, and it calls<br \/>\nthe prog after it was freed:<\/p>\n<p>  BUG: KASAN: vmalloc-out-of-bounds in __bpf_prog_enter_recur+0x3a5\/0x3f0<br \/>\n  Read of size 8 at addr ffffc90000055040 by task candidate\/110<br \/>\n  CPU: 1 UID: 0 PID: 110 Comm: candidate Not tainted 7.3.0-rc2-00014-g15071f2a1263-dirty #2 PREEMPT(full)<br \/>\n  Call Trace:<\/p>\n<p>   __bpf_prog_enter_recur+0x3a5\/0x3f0<br \/>\n   bpf_trampoline_6442509193+0x37\/0xf1<br \/>\n   __x64_sys_futex+0x9\/0x410<br \/>\n   do_syscall_64+0xb0\/0x530<br \/>\n   &#8230;<\/p>\n<p>Wait for an RCU tasks grace period before the existing one when freeing<br \/>\na prog that was linked to a trampoline. An RCU tasks grace period only<br \/>\nends once the tasks that were preempted have run again, and<br \/>\nbpf_tramp_image_put() already relies on it to free the image. It doesn&#8217;t<br \/>\nwait for tasks that sleep in the trampoline, the next commit takes care<br \/>\nof those.<\/p>\n<p>Only progs that were linked to a trampoline can be called this way, so<br \/>\nbpf_trampoline_add_prog() marks them and other progs are still freed as<br \/>\nbefore.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>bpf: Wait for an RCU tasks grace period before freeing trampoline progs<\/p>\n<p>When a prog is detached from a trampoline, it is freed aft<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41272","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41272","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41272"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41272"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41272"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}