CVE-2026-98861

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()

unregister_fprobe() and unregister_fprobe_async() (used by BPF

kprobe-multi) rely on standard RCU grace periods (synchronize_rcu()

and call_rcu()) to wait until in-flight fprobe handlers complete before

freeing the fprobe.

However, if an fprobe handler executes while RCU is not watching (such

as in the idle loop or nohz_full extended quiescent states), standard

RCU does not track preemption-disabled sections. Consequently,

synchronize_rcu() does not wait for those executions, which can lead

to a use-after-free if the fprobe is freed immediately after

unregistration. Ensure handlers exit early when !rcu_is_watching().

Furthermore, fprobe_fgraph_entry() and fprobe_ftrace_entry() previously

used guard(rcu)() and rcu_read_lock(), which invoke lockdep on every

hit under CONFIG_PROVE_LOCKING. This adds overhead and can cause lockdep

recursion if probed func

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References