CVE-2026-98642: Linux kernel · bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in f101602415fb39a58941bec444df65634d5a6844 : patch Linux kernel soon.
Data as of 26 Oct 2026, 17:16 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 6% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in f101602415fb39a58941bec444df65634d5a6844, a0e150a118025a05c8662c536ba2a865da86419c, 1d6581b544a88cf4348c2fb60dcb50ad63f012da +1
Exploitation evidence
Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Linux kernel to f101602415fb39a58941bec444df65634d5a6844, a0e150a118025a05c8662c536ba2a865da86419c, 1d6581b544a88cf4348c2fb60dcb50ad63f012da or 1c21452d02eec2f008e2c5535820f85adbd7587a.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A fix is available and has been applied in the Linux kernel. Users should update to the fixed kernel versions identified by the commits f101602415fb39a58941bec444df65634d5a6844, a0e150a118025a05c8662c536ba2a865da86419c, 1d6581b544a88cf4348c2fb60dcb50ad63f012da, and 1c21452d02eec2f008e2c5535820f85adbd7587a. No additional mitigation is required beyond applying the official patch.
Description
CVE-2026-98642 is a use-after-free (UAF) vulnerability in the Linux kernel's BPF subsystem caused by concurrent access to ttrace lists in the alloc_bulk function. The flaw arises from a race condition between the __free_rcu() callback and alloc_bulk() operations on waiting_for_gp_ttrace and free_by_rcu_ttrace lists, leading to unsafe memory access. The issue has been fixed by adding a raw spinlock to synchronize these concurrent operations.
References
- git.kernel.org/stable/c/a0e150a118025a05c8662c536ba2a865da86419c (opens in a new tab)
- git.kernel.org/stable/c/1d6581b544a88cf4348c2fb60dcb50ad63f012da (opens in a new tab)
- git.kernel.org/stable/c/f101602415fb39a58941bec444df65634d5a6844 (opens in a new tab)
- git.kernel.org/stable/c/1c21452d02eec2f008e2c5535820f85adbd7587a (opens in a new tab)