CVE-2026-98035: Linux kernel · bpf: Cancel special fields when recycling rhtab elements
Affects Linux kernelSource CVE Database V5
Not known to be exploited : upgrade to 65cc95eba9e8b46312cac38c227473605a4b996a or 28fde1356dbc35e20a9f22a5ee65af09698fdf92 when convenient.
Data as of 26 Oct 2026, 13:47 UTC
Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 4% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 65cc95eba9e8b46312cac38c227473605a4b996a, 28fde1356dbc35e20a9f22a5ee65af09698fdf92
Exploitation evidence
Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Linux kernel to 65cc95eba9e8b46312cac38c227473605a4b996a or 28fde1356dbc35e20a9f22a5ee65af09698fdf92.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A fix for this vulnerability is available and has been applied in the Linux kernel. Users should update to the fixed kernel versions identified by commits 65cc95eba9e8b46312cac38c227473605a4b996a and 28fde1356dbc35e20a9f22a5ee65af09698fdf92. No additional mitigation actions are required beyond applying the official patch.
Description
A vulnerability in the Linux kernel's BPF subsystem related to improper handling of special fields when recycling rhtab elements has been resolved. The issue involved unsafe releasing of referenced kernel pointers or complex fields in NMI context during map operations. The fix ensures that asynchronous fields are cancelled safely while deferring final cleanup to the memory allocator destructor.