CVE-2026-98861 Uso después de liberar en fprobe por ejecución fuera de RCU

Afectados

• Linux

  desde 56b4cfcf1518245493c60fd39c56978f508f1816 hasta antes de a85d0f00671b4d4527317c10ba018680f7d8d673desde 657b594b2084b39a4bc6d8493aa2140cb00cea49 hasta antes de dd4a0d4993633b45470abf6da4ea0ca563402245desde 657b594b2084b39a4bc6d8493aa2140cb00cea49 hasta antes de e0a6249190402a28f1e2925a81acf573157d55efa4f6a9005ed6cfd360ef2520430927f05f92ffb0desde 6.18.34 hasta antes de 6.18.56desde 7.0.11 hasta antes de 7.1

• Linux

  7.1

Qué hacer

1. Verificá si usás Linux y en qué versión.
2. Actualizá a la versión corregida que indique el fabricante en su aviso o aplicá su mitigación.
3. Revisá registros y accesos de los sistemas expuestos para descartar un uso previo.

Calculadora CVSS

Esta vulnerabilidad todavía no tiene vector CVSS publicado.

Descripción original

In the Linux kernel, the following vulnerability has been resolved: fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching() unregister_fprobe() and unregister_fprobe_async() (used by BPF kprobe-multi) rely on standard RCU grace periods (synchronize_rcu() and call_rcu()) to wait until in-flight fprobe handlers complete before freeing the fprobe. However, if an fprobe handler executes while RCU is not watching (such as in the idle loop or nohz_full extended quiescent states), standard RCU does not track preemption-disabled sections. Consequently, synchronize_rcu() does not wait for those executions, which can lead to a use-after-free if the fprobe is freed immediately after unregistration. Ensure handlers exit early when !rcu_is_watching(). Furthermore, fprobe_fgraph_entry() and fprobe_ftrace_entry() previously used guard(rcu)() and rcu_read_lock(), which invoke lockdep on every hit under CONFIG_PROVE_LOCKING. This adds overhead and can cause lockdep recursion if probed functions interact with lockdep. Since rhltable_lookup() and rhl_for_each_entry_rcu() use rcu_dereference_all_check() (which checks rcu_read_lock_any_held()), holding preemption disabled via rcu_read_lock_sched_notrace() is fully valid and sufficient so long as rcu_is_watching() is true. Define and use guard(rcu_sched_notrace)() across fprobe_ftrace_entry(), fprobe_fgraph_entry(), and fprobe_return(). This eliminates fast-path rcu_read_lock() and lockdep overhead while guaranteeing safe grace period synchronization.

Referencias (3)

• git.kernel.org/stable/c/a85d0f00671b4d4527317c10ba018680f7d8d673
• git.kernel.org/stable/c/dd4a0d4993633b45470abf6da4ea0ca563402245
• git.kernel.org/stable/c/e0a6249190402a28f1e2925a81acf573157d55ef

Resumen traducido automáticamente de la descripción original. Fuente: Nureq Monitor. Cómo funciona.