CVE-2026-98060

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject resilient lock operations in rbtree callbacks

__bpf_rbtree_add() keeps parent and link pointers live across calls to the

program-supplied comparison callback. The verifier therefore requires the

root's lock to remain held throughout the callback.

The helper path enforces this rule for bpf_spin_lock() and

bpf_spin_unlock(), but the resilient lock kfunc argument path does not.

Since resilient locks may protect BPF rbtree roots, a callback can release

the root lock and let another CPU remove and free the node referenced by

the in-progress tree walk. The walk then resumes using freed pointers.

Reject resilient lock kfuncs in an rbtree comparison callback, matching

the existing policy for the spin lock helpers. Resilient-lock-protected

trees remain valid when their comparison callbacks leave lock state alone.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References