{"api_version":"1","generated_at":"2026-09-25T12:40:15+00:00","cve":"CVE-2026-98047","urls":{"html":"https://cve.report/CVE-2026-98047","api":"https://cve.report/api/cve/CVE-2026-98047.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-98047","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-98047"},"summary":{"title":"bpf: Check ancestor frames for rbtree callbacks","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check ancestor frames for rbtree callbacks\n\nbpf_rbtree_add() invokes its comparator while the caller holds the root\nlock. The native insertion code retains raw parent and link pointers across\nthe callback, so the verifier prohibits unlocking, consuming tree nodes,\nor changing RCU state from that callback.\n\nin_rbtree_lock_required_cb() only checks the innermost verifier frame.\nStatic subprogram calls are permitted while holding a spin lock, and such a\ncall pushes a frame without in_callback_fn set. Consequently, all callback\nrestrictions disappear in the nested frame. The subprogram can unlock the\ntree, remove and drop the node being compared, then relock. Native insertion\nresumes with the stale parent pointer and links freed memory into the tree.\n\nWalk all active frames for the rbtree callback instead. Benign static\nsubprograms remain permitted, while callback restrictions follow execution\ninto nested frames.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-25 11:17:33","updated_at":"2026-09-25 11:17:33"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/369f4ce734570bdfedaa4b5ca50e2a3f6a892728","name":"https://git.kernel.org/stable/c/369f4ce734570bdfedaa4b5ca50e2a3f6a892728","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/2410cb2ac0416dd2795a81984c8c73d7250bd8c4","name":"https://git.kernel.org/stable/c/2410cb2ac0416dd2795a81984c8c73d7250bd8c4","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b545fa447e09e6844868deb2bee228827fe54d15","name":"https://git.kernel.org/stable/c/b545fa447e09e6844868deb2bee228827fe54d15","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98047","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98047","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a44b1334aadd82203f661adb9adb41e53ad0e8d1 b545fa447e09e6844868deb2bee228827fe54d15 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a44b1334aadd82203f661adb9adb41e53ad0e8d1 2410cb2ac0416dd2795a81984c8c73d7250bd8c4 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a44b1334aadd82203f661adb9adb41e53ad0e8d1 369f4ce734570bdfedaa4b5ca50e2a3f6a892728 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.9","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.9 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.53 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.7 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b545fa447e09e6844868deb2bee228827fe54d15","status":"affected","version":"a44b1334aadd82203f661adb9adb41e53ad0e8d1","versionType":"git"},{"lessThan":"2410cb2ac0416dd2795a81984c8c73d7250bd8c4","status":"affected","version":"a44b1334aadd82203f661adb9adb41e53ad0e8d1","versionType":"git"},{"lessThan":"369f4ce734570bdfedaa4b5ca50e2a3f6a892728","status":"affected","version":"a44b1334aadd82203f661adb9adb41e53ad0e8d1","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.9"},{"lessThan":"6.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.53","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.7","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.53","versionStartIncluding":"6.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.7","versionStartIncluding":"6.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc2","versionStartIncluding":"6.9","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check ancestor frames for rbtree callbacks\n\nbpf_rbtree_add() invokes its comparator while the caller holds the root\nlock. The native insertion code retains raw parent and link pointers across\nthe callback, so the verifier prohibits unlocking, consuming tree nodes,\nor changing RCU state from that callback.\n\nin_rbtree_lock_required_cb() only checks the innermost verifier frame.\nStatic subprogram calls are permitted while holding a spin lock, and such a\ncall pushes a frame without in_callback_fn set. Consequently, all callback\nrestrictions disappear in the nested frame. The subprogram can unlock the\ntree, remove and drop the node being compared, then relock. Native insertion\nresumes with the stale parent pointer and links freed memory into the tree.\n\nWalk all active frames for the rbtree callback instead. Benign static\nsubprograms remain permitted, while callback restrictions follow execution\ninto nested frames."}],"providerMetadata":{"dateUpdated":"2026-09-25T10:23:57.347Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/b545fa447e09e6844868deb2bee228827fe54d15"},{"url":"https://git.kernel.org/stable/c/2410cb2ac0416dd2795a81984c8c73d7250bd8c4"},{"url":"https://git.kernel.org/stable/c/369f4ce734570bdfedaa4b5ca50e2a3f6a892728"}],"title":"bpf: Check ancestor frames for rbtree callbacks","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-98047","datePublished":"2026-09-25T10:23:57.347Z","dateReserved":"2026-09-25T10:19:56.072Z","dateUpdated":"2026-09-25T10:23:57.347Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-25 11:17:33","lastModifiedDate":"2026-09-25 11:17:33","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"98047","Ordinal":"1","Title":"bpf: Check ancestor frames for rbtree callbacks","CVE":"CVE-2026-98047","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"98047","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check ancestor frames for rbtree callbacks\n\nbpf_rbtree_add() invokes its comparator while the caller holds the root\nlock. The native insertion code retains raw parent and link pointers across\nthe callback, so the verifier prohibits unlocking, consuming tree nodes,\nor changing RCU state from that callback.\n\nin_rbtree_lock_required_cb() only checks the innermost verifier frame.\nStatic subprogram calls are permitted while holding a spin lock, and such a\ncall pushes a frame without in_callback_fn set. Consequently, all callback\nrestrictions disappear in the nested frame. The subprogram can unlock the\ntree, remove and drop the node being compared, then relock. Native insertion\nresumes with the stale parent pointer and links freed memory into the tree.\n\nWalk all active frames for the rbtree callback instead. Benign static\nsubprograms remain permitted, while callback restrictions follow execution\ninto nested frames.","Type":"Description","Title":"bpf: Check ancestor frames for rbtree callbacks"}]}}}