In the Linux kernel, the following vulnerability has been resolved: fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()… (CVE-2026-98861)

The vulnerability in the Linux kernel's fprobe mechanism involves unregister_fprobe() and unregister_fprobe_async() relying on standard RCU grace periods (synchronize_rcu() and call_rcu()) to wait for in-flight fprobe handlers to complete before freeing the fprobe. However, if an fprobe handler executes while RCU is not watching (e.g., in idle loop or nohz_full extended quiescent states), the standard RCU does not track these preemption-disabled sections, causing synchronize_rcu() to not wait for those executions. This can result in a use-after-free condition if the fprobe is freed immediately after unregistration. The fix ensures handlers exit early when !rcu_is_watching() and replaces rcu_read_lock() with rcu_read_lock_sched_notrace() to reduce lockdep overhead and avoid recursion, using guard(rcu_sched_notrace) across relevant fprobe entry points to guarantee safe grace period synchronization.

This vulnerability can lead to a use-after-free condition in the Linux kernel's fprobe subsystem, potentially causing kernel crashes or undefined behavior. The issue occurs when fprobe handlers execute during periods when RCU is not watching, and the system incorrectly assumes handlers have completed before freeing resources. No known exploits in the wild have been reported.

A fix for this vulnerability has been implemented in the Linux kernel by introducing guard(rcu_sched_notrace) and checks for rcu_is_watching() in fprobe handlers to ensure safe synchronization and prevent use-after-free. Users should update to the fixed kernel versions once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.