# CVE-2026-98799: bpf: Skip detached progs in trampoline images that are still in use

CVE-2026-98799 is fixed in linux on 1 platform by DEBIAN-CVE-2026-98799 (version 7.2.10-1), released October 19, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-98799
- Priority: Routine
- CVSS: 5.2 (Moderate)
- EPSS: 0.0016
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 18, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98799

## Description

In the Linux kernel, the following vulnerability has been resolved:  bpf: Skip detached progs in trampoline images that are still in use  bpf_tramp_image_put() makes sure a trampoline image is not freed while a task may still be running in it, but nothing similar is done for the progs called by that image. Detach drops the last prog reference right away and the prog is freed after grace periods, on the basis that a task still in the traced function skips the fexit progs once the nop at ip_after_call is patched to a jump.  That leaves out a task sleeping in a sleepable prog that runs before the detached one, which no grace period waits for:    CPU 0                               CPU 1   in image I, sleeping in prog S                                       detach P from I's trampoline                                        -> new image, bpf_tramp_image_put(I)                                       bpf_prog_put(P), last ref                                       grace periods, P freed   back from S   __bpf_prog_enter(P)   call P->bpf_func  If S and P are fexit progs the task is already past the patched jump, and fentry only images don't have one. On x86 this is an int3 in poisoned bpf_prog_pack memory:    Oops: int3: 0000 [#1] SMP NOPTI   CPU: 18 UID: 0 PID: 94573 Comm: x169 Not tainted 6.18.44 #1 PREEMPT(lazy)   RIP: 0010:0xffffffffc0601d8d   Call Trace:    <TASK>    ? bpf_trampoline_6442515411+0x1a4/0x21b    bpf_lsm_bprm_committed_creds+0x5/0x10    security_bprm_committed_creds+0x5f/0x70    begin_new_exec+0x2d6/0x410    ...  We hit this in production when progs attached through trampolines got detached while their hooks were busy, and it was independently found with a fuzzer and KASAN.  Have the JITs emit a patchable nop in front of each prog call sequence and record it in the image. When a prog is detached, patch its nop to a jump over the call sequence. Progs that stay attached keep running for the tasks that are in the image, and ip_after_call isn't needed anymore.  The task can be in any image that isn't freed yet, not only in the current one. It sleeps in image I1 that calls S, P and Q, then P is detached and the trampoline moves to image I2, then Q is detached and its call is still in I1. So the trampoline keeps a list of its images until they are freed, and detaching a prog patches its nop in all of them. Images hold a reference on the trampoline for that long.  On riscv and loongarch a jump of any range takes several instructions, and a task preempted in the middle of them could resume into half of the new sequence. The nop is a single instruction there, patched to a near branch through arch_bpf_trampoline_skip().  With the extra nops, BPF_MAX_TRAMP_LINKS progs no longer fit in a page on x86 and arm64 (and already didn't on powerpc), so lower the limit there like s390 does.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 7.2.10-1 | [DEBIAN-CVE-2026-98799](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98799.md) | Oct 19, 2026 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.