« Volver al listado

CVE-2026-98060

Estado: En análisisSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject resilient lock operations in rbtree callbacks

__bpf_rbtree_add() keeps parent and link pointers live across calls to the program-supplied comparison callback. The verifier therefore requires the root's lock to remain held throughout the callback.

The helper path enforces this rule for bpf_spin_lock() and bpf_spin_unlock(), but the resilient lock kfunc argument path does not. Since resilient locks may protect BPF rbtree roots, a callback can release the root lock and let another CPU remove and free the node referenced by the in-progress tree walk. The walk then resumes using freed pointers.

Leer descripción completaMostrar menos

Reject resilient lock kfuncs in an rbtree comparison callback, matching the existing policy for the spin lock helpers. Resilient-lock-protected trees remain valid when their comparison callbacks leave lock state alone.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-98060",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "0de2046137f976e7302d43ac01d9894d07ac1fff",
              "lessThan": "cc2e065ed206aecd9b94564779244f3ffb26e356",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0de2046137f976e7302d43ac01d9894d07ac1fff",
              "lessThan": "71930202a0a0c49f0a3b45b41907a074cb780266",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0de2046137f976e7302d43ac01d9894d07ac1fff",
              "lessThan": "7b7b8b5960102566bd625ae829d1f330c5b5d104",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.15",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-25T11:17:35.000",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/71930202a0a0c49f0a3b45b41907a074cb780266",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7b7b8b5960102566bd625ae829d1f330c5b5d104",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cc2e065ed206aecd9b94564779244f3ffb26e356",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Undergoing Analysis",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject resilient lock operations in rbtree callbacks\n\n__bpf_rbtree_add() keeps parent and link pointers live across calls to the\nprogram-supplied comparison callback. The verifier therefore requires the\nroot's lock to remain held throughout the callback.\n\nThe helper path enforces this rule for bpf_spin_lock() and\nbpf_spin_unlock(), but the resilient lock kfunc argument path does not.\nSince resilient locks may protect BPF rbtree roots, a callback can release\nthe root lock and let another CPU remove and free the node referenced by\nthe in-progress tree walk. The walk then resumes using freed pointers.\n\nReject resilient lock kfuncs in an rbtree comparison callback, matching\nthe existing policy for the spin lock helpers. Resilient-lock-protected\ntrees remain valid when their comparison callbacks leave lock state alone."
    }
  ],
  "lastModified": "2026-09-30T14:10:59.253",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}