Vulnerability-Lookup

GHSA-3W55-5PCM-XP58

Vulnerability from github – Published: 2026-09-25 12:31 – Updated: 2026-09-25 12:31

Details

In the Linux kernel, the following vulnerability has been resolved:

bpf: Preserve special fields in recycled rhtab elements

rhtab_map_update_elem() initializes special fields after obtaining an element from bpf_mem_cache_alloc(). The allocator can return a fresh, zeroed unit, or recycle one from its RCU-pending lists before the registered destructor has run.

A BPF program can retain a map-value pointer after deleting its element and initialize and arm a timer through that pointer. If the deleted unit is recycled, check_and_init_map_value() clears the only pointer to the timer. Neither a later deletion nor rhtab_mem_dtor() can then cancel it, and the callback can run with its key and value pointing into freed memory.

Do not reinitialize special fields on insertion. Fresh allocator units are already zeroed. For recycled units, the special fields are ownership state that must remain visible to the eventual destructor. copy_map_value() already skips those fields, matching the non-preallocated hash-map path and the lifecycle established by commit 275c30bcee66 ("bpf: Don't reinit map value in prealloc_lru_pop").

[ kkd: Split out the fix and rewrote the commit log ]

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-98036"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-25T11:17:32Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Preserve special fields in recycled rhtab elements\n\nrhtab_map_update_elem() initializes special fields after obtaining an\nelement from bpf_mem_cache_alloc(). The allocator can return a fresh,\nzeroed unit, or recycle one from its RCU-pending lists before the\nregistered destructor has run.\n\nA BPF program can retain a map-value pointer after deleting its element\nand initialize and arm a timer through that pointer. If the deleted unit\nis recycled, check_and_init_map_value() clears the only pointer to the\ntimer. Neither a later deletion nor rhtab_mem_dtor() can then cancel it,\nand the callback can run with its key and value pointing into freed memory.\n\nDo not reinitialize special fields on insertion. Fresh allocator units are\nalready zeroed. For recycled units, the special fields are ownership state\nthat must remain visible to the eventual destructor. copy_map_value()\nalready skips those fields, matching the non-preallocated hash-map path and\nthe lifecycle established by commit 275c30bcee66 (\"bpf: Don\u0027t reinit map\nvalue in prealloc_lru_pop\").\n\n[ kkd: Split out the fix and rewrote the commit log ]",
  "id": "GHSA-3w55-5pcm-xp58",
  "modified": "2026-09-25T12:31:34Z",
  "published": "2026-09-25T12:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98036"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5df46ddcb7b36878c1b691e9057a0509042a2567"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6a5266b8288216b86602ff687d528abfb066dfd8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2026-98036 (GCVE-0-2026-98036)

Vulnerability from cvelistv5 – Published: 2026-09-25 10:23 – Updated: 2026-09-25 10:23

Title

bpf: Preserve special fields in recycled rhtab elements

Summary

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve special fields in recycled rhtab elements rhtab_map_update_elem() initializes special fields after obtaining an element from bpf_mem_cache_alloc(). The allocator can return a fresh, zeroed unit, or recycle one from its RCU-pending lists before the registered destructor has run. A BPF program can retain a map-value pointer after deleting its element and initialize and arm a timer through that pointer. If the deleted unit is recycled, check_and_init_map_value() clears the only pointer to the timer. Neither a later deletion nor rhtab_mem_dtor() can then cancel it, and the callback can run with its key and value pointing into freed memory. Do not reinitialize special fields on insertion. Fresh allocator units are already zeroed. For recycled units, the special fields are ownership state that must remain visible to the eventual destructor. copy_map_value() already skips those fields, matching the non-preallocated hash-map path and the lifecycle established by commit 275c30bcee66 ("bpf: Don't reinit map value in prealloc_lru_pop"). [ kkd: Split out the fix and rewrote the commit log ]

Severity

No CVSS data available.

Assigner

Linux mitre root

References

2 references

URL	Tags
https://git.kernel.org/stable/c/6a5266b8288216b86…
https://git.kernel.org/stable/c/5df46ddcb7b36878c…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 6905f8601298ecd2d1932a4b4849bf265201118e , < 6a5266b8288216b86602ff687d528abfb066dfd8 (git) Affected: 6905f8601298ecd2d1932a4b4849bf265201118e , < 5df46ddcb7b36878c1b691e9057a0509042a2567 (git)
Linux	Linux	Affected: 7.2 Unaffected: 0 , < 7.2 (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/hashtab.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6a5266b8288216b86602ff687d528abfb066dfd8",
              "status": "affected",
              "version": "6905f8601298ecd2d1932a4b4849bf265201118e",
              "versionType": "git"
            },
            {
              "lessThan": "5df46ddcb7b36878c1b691e9057a0509042a2567",
              "status": "affected",
              "version": "6905f8601298ecd2d1932a4b4849bf265201118e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/hashtab.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.2"
            },
            {
              "lessThan": "7.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "7.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc2",
                  "versionStartIncluding": "7.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Preserve special fields in recycled rhtab elements\n\nrhtab_map_update_elem() initializes special fields after obtaining an\nelement from bpf_mem_cache_alloc(). The allocator can return a fresh,\nzeroed unit, or recycle one from its RCU-pending lists before the\nregistered destructor has run.\n\nA BPF program can retain a map-value pointer after deleting its element\nand initialize and arm a timer through that pointer. If the deleted unit\nis recycled, check_and_init_map_value() clears the only pointer to the\ntimer. Neither a later deletion nor rhtab_mem_dtor() can then cancel it,\nand the callback can run with its key and value pointing into freed memory.\n\nDo not reinitialize special fields on insertion. Fresh allocator units are\nalready zeroed. For recycled units, the special fields are ownership state\nthat must remain visible to the eventual destructor. copy_map_value()\nalready skips those fields, matching the non-preallocated hash-map path and\nthe lifecycle established by commit 275c30bcee66 (\"bpf: Don\u0027t reinit map\nvalue in prealloc_lru_pop\").\n\n[ kkd: Split out the fix and rewrote the commit log ]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T10:23:50.530Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6a5266b8288216b86602ff687d528abfb066dfd8"
        },
        {
          "url": "https://git.kernel.org/stable/c/5df46ddcb7b36878c1b691e9057a0509042a2567"
        }
      ],
      "title": "bpf: Preserve special fields in recycled rhtab elements",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98036",
    "datePublished": "2026-09-25T10:23:50.530Z",
    "dateReserved": "2026-09-25T10:19:56.071Z",
    "dateUpdated": "2026-09-25T10:23:50.530Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-3W55-5PCM-XP58

CVE-2026-98036 (GCVE-0-2026-98036)

Tags

Sightings

Nomenclature

Related by attack behaviour