In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk… (CVE-2026-98642)

The Linux kernel contained a use-after-free vulnerability (CVE-2026-98642) in the BPF subsystem's memory allocator related to concurrent consumption of ttrace lists in the alloc_bulk function. The root cause was a race condition where __free_rcu() callbacks and alloc_bulk() operations concurrently accessed and modified linked lists (waiting_for_gp_ttrace and free_by_rcu_ttrace) without synchronization. This led to attempts to access freed memory, triggering KASAN slab-use-after-free errors. The vulnerability was demonstrated by Syzkaller fuzzing. The fix involved adding a raw spinlock to protect these concurrent list operations, preventing the race condition and subsequent use-after-free.

The vulnerability allows use-after-free conditions in kernel memory management, which can lead to kernel crashes or memory corruption. While no active exploitation in the wild is known, such flaws can potentially be leveraged for privilege escalation or denial of service if exploited.

A fix is available that introduces a raw spinlock to synchronize concurrent access to the affected ttrace lists in the BPF memory allocator. Users should apply the official Linux kernel updates that include this patch to remediate the vulnerability. No alternative mitigations are indicated.