{
  "cveId": "CVE-2026-98813",
  "url": "https://patchblox.com/security/cve/CVE-2026-98813",
  "summary": "CVE-2026-98813 is fixed in linux on 1 platform by DEBIAN-CVE-2026-98813 (version 7.2.10-1), released October 19, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  bpf: Hold map BTF for the memory allocator destr...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  bpf: Hold map BTF for the memory allocator destructor record  bpf_ma_set_dtor() duplicates map-\u003Erecord so that the bpf_mem_alloc destructor can release the special fields of hash and rhash map elements once the allocator frees them for good. btf_record_dup() only acquires references on kernel and module BTF. Fields whose types live in the map BTF keep pointing into it: a kptr to a local type refers to map-\u003Ebtf, and a list_head or rb_root field carries a value_rec owned by the struct meta table of map-\u003Ebtf.  That borrowed state can outlive the map. When RCU callbacks are still in flight, bpf_mem_alloc_destroy() copies the allocator and defers the final drain, together with the destructor context, to a workqueue. bpf_map_free() then frees map-\u003Erecord and drops the map\u0027s BTF reference as soon as map_free() returns. Once the program that loaded the BTF is gone as well, the BTF is freed while the worker still uses the duplicate. The worker dereferences it through btf_is_kernel() and btf_find_struct_meta() in bpf_obj_free_fields() when destroying elements that were freed under RCU, and through btf_is_kernel() in btf_record_free() when releasing the context itself:    BUG: KASAN: slab-use-after-free in btf_is_kernel\u002B0x19/0x30   Read of size 1 at addr ffff88811505dce8 by task kworker/u16:2/50   Workqueue: events_unbound free_mem_alloc_deferred   Call Trace:    btf_is_kernel\u002B0x19/0x30    btf_record_free\u002B0xc7/0xf0    htab_dtor_ctx_free\u002B0x1a/0x30    free_mem_alloc_no_barrier\u002B0x39/0x230    free_mem_alloc_deferred\u002B0x2a/0x40    process_scheduled_works\u002B0x5ce/0x9d0    worker_thread\u002B0x42a/0x5e0    kthread\u002B0x1f5/0x230    ret_from_fork\u002B0x1dd/0x390    ret_from_fork_asm\u002B0x1a/0x30    Allocated by task 358:    __kmalloc_cache_noprof\u002B0x287/0x510    btf_new_fd\u002B0xf7/0x3d0    __sys_bpf\u002B0x487/0x840    Freed by task 0:    kfree\u002B0x186/0x560    rcu_core\u002B0x6f6/0xd40  Freeing a map that still holds more elements than the allocator\u0027s high watermark is enough to get there, because the bulk free during teardown queues the RCU callback that makes bpf_mem_alloc_destroy() defer. Non-preallocated hash maps and resizable hash maps both register the destructor and are affected alike.  Keep one reference on the map BTF in the destructor context. Every non-kernel pointer in the duplicated record is either map-\u003Ebtf or memory owned by it, so a single reference covers kptrs, list heads, and rb roots, and mirrors what bpf_map_meta_alloc() does for the duplicated record of an inner map. Release it only after the duplicated record has been freed: the worker is preemptible and not in an RCU read-side critical section, so dropping the last reference first would let the BTF be freed while btf_record_free() still reads its fields.",
  "published": "2026-10-18T16:17:35Z",
  "severity": "",
  "epss": 0.00155,
  "epssPercentile": 0.04693,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.10-1",
      "fix": "DEBIAN-CVE-2026-98813",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98813",
      "released": "2026-10-19T16:27:52Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T13:31:49Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}