CVE-2026-98861: Linux kernel · fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in e0a6249190402a28f1e2925a81acf573157d55ef : patch Linux kernel soon.
Data as of 26 Oct 2026, 17:16 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in e0a6249190402a28f1e2925a81acf573157d55ef, dd4a0d4993633b45470abf6da4ea0ca563402245, a85d0f00671b4d4527317c10ba018680f7d8d673 +2
Exploitation evidence
Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A fix is available in Linux kernel versions 6.18.56, 7.0.11 and later, and 7.1. Users should upgrade to these fixed versions or later to mitigate the vulnerability. No additional mitigation is required beyond applying the official kernel updates.
Description
CVE-2026-98861 is a vulnerability in the Linux kernel's fprobe subsystem where improper handling of RCU (Read-Copy-Update) grace periods can lead to use-after-free conditions. The issue arises because fprobe handlers may execute when RCU is not watching, such as during idle loops or extended quiescent states, causing synchronize_rcu() to miss waiting for in-flight handlers. The vulnerability has been addressed by using guard(rcu_sched_notrace) and checking rcu_is_watching() to ensure safe synchronization and eliminate lockdep overhead.