{"api_version":"1","generated_at":"2026-10-20T05:18:35+00:00","cve":"CVE-2026-98861","urls":{"html":"https://cve.report/CVE-2026-98861","api":"https://cve.report/api/cve/CVE-2026-98861.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-98861","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-98861"},"summary":{"title":"fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()\n\nunregister_fprobe() and unregister_fprobe_async() (used by BPF\nkprobe-multi) rely on standard RCU grace periods (synchronize_rcu()\nand call_rcu()) to wait until in-flight fprobe handlers complete before\nfreeing the fprobe.\n\nHowever, if an fprobe handler executes while RCU is not watching (such\nas in the idle loop or nohz_full extended quiescent states), standard\nRCU does not track preemption-disabled sections. Consequently,\nsynchronize_rcu() does not wait for those executions, which can lead\nto a use-after-free if the fprobe is freed immediately after\nunregistration. Ensure handlers exit early when !rcu_is_watching().\n\nFurthermore, fprobe_fgraph_entry() and fprobe_ftrace_entry() previously\nused guard(rcu)() and rcu_read_lock(), which invoke lockdep on every\nhit under CONFIG_PROVE_LOCKING. This adds overhead and can cause lockdep\nrecursion if probed functions interact with lockdep.\n\nSince rhltable_lookup() and rhl_for_each_entry_rcu() use\nrcu_dereference_all_check() (which checks rcu_read_lock_any_held()),\nholding preemption disabled via rcu_read_lock_sched_notrace() is fully\nvalid and sufficient so long as rcu_is_watching() is true.\n\nDefine and use guard(rcu_sched_notrace)() across fprobe_ftrace_entry(),\nfprobe_fgraph_entry(), and fprobe_return(). This eliminates fast-path\nrcu_read_lock() and lockdep overhead while guaranteeing safe grace\nperiod synchronization.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-10-18 16:17:40","updated_at":"2026-10-19 10:19:50"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/a85d0f00671b4d4527317c10ba018680f7d8d673","name":"https://git.kernel.org/stable/c/a85d0f00671b4d4527317c10ba018680f7d8d673","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e0a6249190402a28f1e2925a81acf573157d55ef","name":"https://git.kernel.org/stable/c/e0a6249190402a28f1e2925a81acf573157d55ef","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/dd4a0d4993633b45470abf6da4ea0ca563402245","name":"https://git.kernel.org/stable/c/dd4a0d4993633b45470abf6da4ea0ca563402245","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98861","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98861","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 56b4cfcf1518245493c60fd39c56978f508f1816 a85d0f00671b4d4527317c10ba018680f7d8d673 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 657b594b2084b39a4bc6d8493aa2140cb00cea49 dd4a0d4993633b45470abf6da4ea0ca563402245 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 657b594b2084b39a4bc6d8493aa2140cb00cea49 e0a6249190402a28f1e2925a81acf573157d55ef git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a4f6a9005ed6cfd360ef2520430927f05f92ffb0 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.18.34 6.18.56 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7.0.11 7.1 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7.1","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.56 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.10 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/trace/fprobe.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a85d0f00671b4d4527317c10ba018680f7d8d673","status":"affected","version":"56b4cfcf1518245493c60fd39c56978f508f1816","versionType":"git"},{"lessThan":"dd4a0d4993633b45470abf6da4ea0ca563402245","status":"affected","version":"657b594b2084b39a4bc6d8493aa2140cb00cea49","versionType":"git"},{"lessThan":"e0a6249190402a28f1e2925a81acf573157d55ef","status":"affected","version":"657b594b2084b39a4bc6d8493aa2140cb00cea49","versionType":"git"},{"status":"affected","version":"a4f6a9005ed6cfd360ef2520430927f05f92ffb0","versionType":"git"},{"lessThan":"6.18.56","status":"affected","version":"6.18.34","versionType":"semver"},{"lessThan":"7.1","status":"affected","version":"7.0.11","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/trace/fprobe.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"7.1"},{"lessThan":"7.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.56","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.56","versionStartIncluding":"6.18.34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.10","versionStartIncluding":"7.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3","versionStartIncluding":"7.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.11","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()\n\nunregister_fprobe() and unregister_fprobe_async() (used by BPF\nkprobe-multi) rely on standard RCU grace periods (synchronize_rcu()\nand call_rcu()) to wait until in-flight fprobe handlers complete before\nfreeing the fprobe.\n\nHowever, if an fprobe handler executes while RCU is not watching (such\nas in the idle loop or nohz_full extended quiescent states), standard\nRCU does not track preemption-disabled sections. Consequently,\nsynchronize_rcu() does not wait for those executions, which can lead\nto a use-after-free if the fprobe is freed immediately after\nunregistration. Ensure handlers exit early when !rcu_is_watching().\n\nFurthermore, fprobe_fgraph_entry() and fprobe_ftrace_entry() previously\nused guard(rcu)() and rcu_read_lock(), which invoke lockdep on every\nhit under CONFIG_PROVE_LOCKING. This adds overhead and can cause lockdep\nrecursion if probed functions interact with lockdep.\n\nSince rhltable_lookup() and rhl_for_each_entry_rcu() use\nrcu_dereference_all_check() (which checks rcu_read_lock_any_held()),\nholding preemption disabled via rcu_read_lock_sched_notrace() is fully\nvalid and sufficient so long as rcu_is_watching() is true.\n\nDefine and use guard(rcu_sched_notrace)() across fprobe_ftrace_entry(),\nfprobe_fgraph_entry(), and fprobe_return(). This eliminates fast-path\nrcu_read_lock() and lockdep overhead while guaranteeing safe grace\nperiod synchronization."}],"providerMetadata":{"dateUpdated":"2026-10-19T09:26:55.805Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/a85d0f00671b4d4527317c10ba018680f7d8d673"},{"url":"https://git.kernel.org/stable/c/dd4a0d4993633b45470abf6da4ea0ca563402245"},{"url":"https://git.kernel.org/stable/c/e0a6249190402a28f1e2925a81acf573157d55ef"}],"title":"fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-98861","datePublished":"2026-10-18T15:51:22.271Z","dateReserved":"2026-09-25T10:25:14.376Z","dateUpdated":"2026-10-19T09:26:55.805Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-18 16:17:40","lastModifiedDate":"2026-10-19 10:19:50","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"98861","Ordinal":"1","Title":"fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()","CVE":"CVE-2026-98861","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"98861","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nfprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()\n\nunregister_fprobe() and unregister_fprobe_async() (used by BPF\nkprobe-multi) rely on standard RCU grace periods (synchronize_rcu()\nand call_rcu()) to wait until in-flight fprobe handlers complete before\nfreeing the fprobe.\n\nHowever, if an fprobe handler executes while RCU is not watching (such\nas in the idle loop or nohz_full extended quiescent states), standard\nRCU does not track preemption-disabled sections. Consequently,\nsynchronize_rcu() does not wait for those executions, which can lead\nto a use-after-free if the fprobe is freed immediately after\nunregistration. Ensure handlers exit early when !rcu_is_watching().\n\nFurthermore, fprobe_fgraph_entry() and fprobe_ftrace_entry() previously\nused guard(rcu)() and rcu_read_lock(), which invoke lockdep on every\nhit under CONFIG_PROVE_LOCKING. This adds overhead and can cause lockdep\nrecursion if probed functions interact with lockdep.\n\nSince rhltable_lookup() and rhl_for_each_entry_rcu() use\nrcu_dereference_all_check() (which checks rcu_read_lock_any_held()),\nholding preemption disabled via rcu_read_lock_sched_notrace() is fully\nvalid and sufficient so long as rcu_is_watching() is true.\n\nDefine and use guard(rcu_sched_notrace)() across fprobe_ftrace_entry(),\nfprobe_fgraph_entry(), and fprobe_return(). This eliminates fast-path\nrcu_read_lock() and lockdep overhead while guaranteeing safe grace\nperiod synchronization.","Type":"Description","Title":"fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()"}]}}}