In the Linux kernel, the following vulnerability has been resolved: bpf: Fix objects stuck in free_by_rcu_ttrace do_call_rcu_ttrace() returns early… (CVE-2026-98789)

The vulnerability in the Linux kernel involves the BPF subsystem's memory management where do_call_rcu_ttrace() returns early when call_rcu_ttrace_in_progress is set, causing objects to remain stuck in free_by_rcu_ttrace. The __free_rcu() function only frees waiting_for_gp_ttrace and clears the flag, but objects added during an ongoing RCU tasks trace remain until free_bulk() or alloc_bulk() is called again, which may never occur, leading to unbounded object accumulation. The fix changes call_rcu_ttrace_in_progress from a binary flag to a three-state variable (0 idle, 1 __free_rcu() queued, 2 __free_rcu() queued with more objects added) to ensure proper queuing and freeing of objects. Additional synchronization changes prevent race conditions and ensure that memory caches are freed correctly without indefinite delays or resource buildup.

The vulnerability can cause unbounded accumulation of unreleased objects in the kernel's BPF memory cache, potentially leading to resource exhaustion or degraded system performance. There is no indication of direct code execution or privilege escalation from the provided data. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to address this issue by modifying the state management and synchronization of RCU tasks tracing and freeing mechanisms. Users should apply the official kernel updates that include this fix once available. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisory for current remediation guidance.