In the Linux kernel, the following vulnerability has been resolved: bpf: Hold map BTF for the memory allocator destructor record bpf_ma_set_dtor()… (CVE-2026-98813)

The vulnerability in the Linux kernel's BPF subsystem involves the bpf_ma_set_dtor() function duplicating map records that contain pointers to the map's BTF (BPF Type Format) data. The BTF references were released too early when the map was freed, while deferred RCU callbacks still accessed these references, causing use-after-free errors and kernel memory corruption. The fix ensures that a reference to the map BTF is held in the destructor context until all deferred work has completed, preventing premature freeing of BTF data during destruction of hash and resizable hash map elements.

This vulnerability can cause kernel memory corruption and use-after-free errors, potentially leading to kernel crashes or instability. There is no information about known exploits in the wild. The impact is limited to kernel memory safety and stability.

A fix has been implemented in the Linux kernel to hold a reference on the map BTF during the destructor context to prevent use-after-free conditions. Users should update to the fixed kernel version once available. No additional mitigation is indicated.