In the Linux kernel, the following vulnerability has been resolved: bpf: Skip detached progs in trampoline images that are still in use… (CVE-2026-98799)

The vulnerability in the Linux kernel's BPF trampoline mechanism stemmed from improper handling of detached BPF programs within trampoline images. While the trampoline image itself was protected from being freed while in use, the individual BPF programs called by the image were not similarly protected. When a program was detached, its last reference was dropped immediately, and it was freed after grace periods without accounting for tasks sleeping in other BPF programs that called the detached program. This could cause tasks to resume execution in freed program memory, resulting in kernel crashes (e.g., int3 traps). The fix involves having JIT compilers emit patchable no-op instructions before each program call, which are patched to jumps when a program is detached, ensuring that tasks running in any trampoline image are not exposed to freed program memory. This also required lowering the maximum number of trampoline links on some architectures due to increased instruction size.

The vulnerability could lead to kernel crashes (Oops) due to tasks resuming execution in freed BPF program memory after detachment. This affects system stability and could cause denial of service. There is no indication of code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to address this vulnerability by patching no-op instructions to jumps when BPF programs are detached, preventing premature freeing of programs still in use. Users should update to the fixed Linux kernel versions containing this patch. No additional mitigations are indicated.