# CVE-2026-98642: bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk CVE-2026-98642 is fixed in 39 products on 1 platform, first by DEBIAN-CVE-2026-98642, released October 19, 2026. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2026-98642 - Priority: Routine - CVSS: 6.4 (Moderate) - EPSS: 0.0017 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Oct 18, 2026 - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98642 ## Description In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk Syzkaller repeatedly triggered UAF splats related to nodes in waiting_for_gp_ttrace within the bpf memalloc: BUG: KASAN: slab-use-after-free in llist_del_first+0x85/0x110 lib/llist.c:61 Read of size 8 at addr ffff8881572cd080 by task syz.4.470/5112 ... llist_del_first+0x85/0x110 lib/llist.c:61 alloc_bulk+0x193/0x460 kernel/bpf/memalloc.c:229 bpf_mem_refill+0x386/0x560 kernel/bpf/memalloc.c:436 Freed by task 14: ... __free_rcu kernel/bpf/memalloc.c:281 [inline] __free_rcu_tasks_trace+0x48/0xd0 kernel/bpf/memalloc.c:291 rcu_tasks_invoke_cbs+0x1ec/0x3e0 kernel/rcu/tasks.h:571 rcu_tasks_one_gp+0x13d/0x220 kernel/rcu/tasks.h:621 rcu_tasks_kthread+0xf3/0x120 kernel/rcu/tasks.h:651 The reason is that the UAF occurs after the RCU Tasks Trace GP expires: when the __free_rcu() callback runs, there is no synchronization protecting llist_del_all() against concurrent alloc_bulk() operating on waiting_for_gp_ttrace, leading to the race condition below: CPU0 CPU1 __free_rcu (RCU Tasks Trace callback) alloc_bulk llist_del_first(&c->waiting_for_gp_ttrace) entry = smp_load_acquire(&head->first); do { if (entry == NULL) return NULL; free_all(llist_del_all(&c->waiting_for_gp_ttrace)) llist_for_each_safe(pos, t, llnode) free_one(pos); next = READ_ONCE(entry->next); <-- trigger UAF } while (!try_cmpxchg(&head->first, &entry, next)); In addition, there is also a theoretical race condition on the free_by_rcu_ttrace list. This race requires two preconditions: an in-flight Tasks Trace GP keeping c->call_rcu_ttrace_in_progress == 1, and concurrent cross-CPU frees repopulating c->free_by_rcu_ttrace with new nodes. Under these conditions, the following scenario triggers UAF: // CPU0 // irq work is still busy (on PREEMPT_RT) alloc_bulk() llist_del_first(&c->free_by_rcu_ttrace) entry = smp_load_acquire(&head->first); do { if (entry == NULL) return NULL; // CPU1 bpf_mem_alloc_destroy() WRITE_ONCE(c->draining, true) // wait for CPU0 irq_work_sync() // CPU2 do_call_rcu_ttrace(tgt(CPU0)) if (c->draining) { llist_del_all(&c->free_by_rcu_ttrace) free_all() } // CPU0 continue next = READ_ONCE(entry->next); <-- trigger UAF while (!try_cmpxchg(&head->first, &entry, next)); Fix this by introducing a raw spinlock to synchronize the concurrent consumption on waiting_for_gp_ttrace and free_by_rcu_ttrace. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | bpftool6.12 amzn 2023 | 1:6.12.113-138.209.amzn2023 | [ALAS2023-2026-3335](https://patchblox.com/security/data/fix/linux/alas2023-2026-3335.md) | Nov 7, 2026 | | Linux | bpftool6.12-debuginfo amzn 2023 | 1:6.12.113-138.209.amzn2023 | [ALAS2023-2026-3335](https://patchblox.com/security/data/fix/linux/alas2023-2026-3335.md) | Nov 7, 2026 | | Linux | bpftool6.18 amzn 2023 | 1:6.18.56-125.164.amzn2023 | [ALAS2023-2026-3251](https://patchblox.com/security/data/fix/linux/alas2023-2026-3251.md) | Nov 7, 2026 | | Linux | bpftool6.18-debuginfo amzn 2023 | 1:6.18.56-125.164.amzn2023 | [ALAS2023-2026-3251](https://patchblox.com/security/data/fix/linux/alas2023-2026-3251.md) | Nov 7, 2026 | | Linux | kernel-livepatch-6.12.113-138.209 amzn 2023 | 1:1.0-0.amzn2023 | [ALAS2023-2026-3335](https://patchblox.com/security/data/fix/linux/alas2023-2026-3335.md) | Nov 7, 2026 | | Linux | kernel-livepatch-6.18.56-125.164 amzn 2023 | 1:1.0-0.amzn2023 | [ALAS2023-2026-3251](https://patchblox.com/security/data/fix/linux/alas2023-2026-3251.md) | Nov 7, 2026 | | Linux | kernel6.12 amzn 2023 | 1:6.12.113-138.209.amzn2023 | [ALAS2023-2026-3335](https://patchblox.com/security/data/fix/linux/alas2023-2026-3335.md) | Nov 7, 2026 | | Linux | kernel6.12-debuginfo amzn 2023 | 1:6.12.113-138.209.amzn2023 | [ALAS2023-2026-3335](https://patchblox.com/security/data/fix/linux/alas2023-2026-3335.md) | Nov 7, 2026 | | Linux | kernel6.12-debuginfo-common-aarch64 amzn 2023 | 1:6.12.113-138.209.amzn2023 | [ALAS2023-2026-3335](https://patchblox.com/security/data/fix/linux/alas2023-2026-3335.md) | Nov 7, 2026 | | Linux | kernel6.12-debuginfo-common-x86_64 amzn 2023 | 1:6.12.113-138.209.amzn2023 | [ALAS2023-2026-3335](https://patchblox.com/security/data/fix/linux/alas2023-2026-3335.md) | Nov 7, 2026 | | Linux | kernel6.12-devel amzn 2023 | 1:6.12.113-138.209.amzn2023 | [ALAS2023-2026-3335](https://patchblox.com/security/data/fix/linux/alas2023-2026-3335.md) | Nov 7, 2026 | | Linux | kernel6.12-headers amzn 2023 | 1:6.12.113-138.209.amzn2023 | [ALAS2023-2026-3335](https://patchblox.com/security/data/fix/linux/alas2023-2026-3335.md) | Nov 7, 2026 | | Linux | kernel6.12-modules-extra amzn 2023 | 1:6.12.113-138.209.amzn2023 | [ALAS2023-2026-3335](https://patchblox.com/security/data/fix/linux/alas2023-2026-3335.md) | Nov 7, 2026 | | Linux | kernel6.12-modules-extra-common amzn 2023 | 1:6.12.113-138.209.amzn2023 | [ALAS2023-2026-3335](https://patchblox.com/security/data/fix/linux/alas2023-2026-3335.md) | Nov 7, 2026 | | Linux | kernel6.12-tools amzn 2023 | 1:6.12.113-138.209.amzn2023 | [ALAS2023-2026-3335](https://patchblox.com/security/data/fix/linux/alas2023-2026-3335.md) | Nov 7, 2026 | | Linux | kernel6.12-tools-debuginfo amzn 2023 | 1:6.12.113-138.209.amzn2023 | [ALAS2023-2026-3335](https://patchblox.com/security/data/fix/linux/alas2023-2026-3335.md) | Nov 7, 2026 | | Linux | kernel6.12-tools-devel amzn 2023 | 1:6.12.113-138.209.amzn2023 | [ALAS2023-2026-3335](https://patchblox.com/security/data/fix/linux/alas2023-2026-3335.md) | Nov 7, 2026 | | Linux | kernel6.18 amzn 2023 | 1:6.18.56-125.164.amzn2023 | [ALAS2023-2026-3251](https://patchblox.com/security/data/fix/linux/alas2023-2026-3251.md) | Nov 7, 2026 | | Linux | kernel6.18-debuginfo amzn 2023 | 1:6.18.56-125.164.amzn2023 | [ALAS2023-2026-3251](https://patchblox.com/security/data/fix/linux/alas2023-2026-3251.md) | Nov 7, 2026 | | Linux | kernel6.18-debuginfo-common-aarch64 amzn 2023 | 1:6.18.56-125.164.amzn2023 | [ALAS2023-2026-3251](https://patchblox.com/security/data/fix/linux/alas2023-2026-3251.md) | Nov 7, 2026 | | Linux | kernel6.18-debuginfo-common-x86_64 amzn 2023 | 1:6.18.56-125.164.amzn2023 | [ALAS2023-2026-3251](https://patchblox.com/security/data/fix/linux/alas2023-2026-3251.md) | Nov 7, 2026 | | Linux | kernel6.18-devel amzn 2023 | 1:6.18.56-125.164.amzn2023 | [ALAS2023-2026-3251](https://patchblox.com/security/data/fix/linux/alas2023-2026-3251.md) | Nov 7, 2026 | | Linux | kernel6.18-headers amzn 2023 | 1:6.18.56-125.164.amzn2023 | [ALAS2023-2026-3251](https://patchblox.com/security/data/fix/linux/alas2023-2026-3251.md) | Nov 7, 2026 | | Linux | kernel6.18-modules-extra amzn 2023 | 1:6.18.56-125.164.amzn2023 | [ALAS2023-2026-3251](https://patchblox.com/security/data/fix/linux/alas2023-2026-3251.md) | Nov 7, 2026 | | Linux | kernel6.18-modules-extra-common amzn 2023 | 1:6.18.56-125.164.amzn2023 | [ALAS2023-2026-3251](https://patchblox.com/security/data/fix/linux/alas2023-2026-3251.md) | Nov 7, 2026 | | Linux | kernel6.18-tools amzn 2023 | 1:6.18.56-125.164.amzn2023 | [ALAS2023-2026-3251](https://patchblox.com/security/data/fix/linux/alas2023-2026-3251.md) | Nov 7, 2026 | | Linux | kernel6.18-tools-debuginfo amzn 2023 | 1:6.18.56-125.164.amzn2023 | [ALAS2023-2026-3251](https://patchblox.com/security/data/fix/linux/alas2023-2026-3251.md) | Nov 7, 2026 | | Linux | kernel6.18-tools-devel amzn 2023 | 1:6.18.56-125.164.amzn2023 | [ALAS2023-2026-3251](https://patchblox.com/security/data/fix/linux/alas2023-2026-3251.md) | Nov 7, 2026 | | Linux | linux Debian 13.5 (trixie) | 6.12.113-1 | [DEBIAN-CVE-2026-98642](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98642.md) | Oct 19, 2026 | | Linux | linux Debian 14 | 7.2.9-1 | [DEBIAN-CVE-2026-98642](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98642.md) | Oct 19, 2026 | | Linux | linux-6.12 Debian 12.15 (bookworm) | 6.12.113-1~deb12u1 | [DEBIAN-CVE-2026-98642](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98642.md) | Oct 19, 2026 | | Linux | microvm-kernel6.18 amzn 2023 | 1:6.18.56-125.164.amzn2023 | [ALAS2023-2026-3251](https://patchblox.com/security/data/fix/linux/alas2023-2026-3251.md) | Nov 7, 2026 | | Linux | perf6.12 amzn 2023 | 1:6.12.113-138.209.amzn2023 | [ALAS2023-2026-3335](https://patchblox.com/security/data/fix/linux/alas2023-2026-3335.md) | Nov 7, 2026 | | Linux | perf6.12-debuginfo amzn 2023 | 1:6.12.113-138.209.amzn2023 | [ALAS2023-2026-3335](https://patchblox.com/security/data/fix/linux/alas2023-2026-3335.md) | Nov 7, 2026 | | Linux | perf6.18 amzn 2023 | 1:6.18.56-125.164.amzn2023 | [ALAS2023-2026-3251](https://patchblox.com/security/data/fix/linux/alas2023-2026-3251.md) | Nov 7, 2026 | | Linux | perf6.18-debuginfo amzn 2023 | 1:6.18.56-125.164.amzn2023 | [ALAS2023-2026-3251](https://patchblox.com/security/data/fix/linux/alas2023-2026-3251.md) | Nov 7, 2026 | | Linux | python3-perf6.12 amzn 2023 | 1:6.12.113-138.209.amzn2023 | [ALAS2023-2026-3335](https://patchblox.com/security/data/fix/linux/alas2023-2026-3335.md) | Nov 7, 2026 | | Linux | python3-perf6.12-debuginfo amzn 2023 | 1:6.12.113-138.209.amzn2023 | [ALAS2023-2026-3335](https://patchblox.com/security/data/fix/linux/alas2023-2026-3335.md) | Nov 7, 2026 | | Linux | python3-perf6.18 amzn 2023 | 1:6.18.56-125.164.amzn2023 | [ALAS2023-2026-3251](https://patchblox.com/security/data/fix/linux/alas2023-2026-3251.md) | Nov 7, 2026 | | Linux | python3-perf6.18-debuginfo amzn 2023 | 1:6.18.56-125.164.amzn2023 | [ALAS2023-2026-3251](https://patchblox.com/security/data/fix/linux/alas2023-2026-3251.md) | Nov 7, 2026 | --- Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.