CVE-2026-98856: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-98856 is a Linux kernel vulnerability in the kprobes subsystem where overlapping optimized probes (optkprobes) are incorrectly handled, potentially causing execution to jump to an unintended memory address. The flaw was introduced as far back as Linux kernel version 2.6.34 and was disclosed on October 18, 2026. Affected kernel versions span from 2.6.34 up to (but not including) the fixed releases: 6.12.113, 6.18.56, 7.2.10, and 7.3-rc6. The CVSS base score is currently listed as 0.0 with a medium severity estimate, reflecting that a formal score has not yet been assigned (GitHub Advisory, Feedly).

The root cause is a logic error in the get_optimized_kprobe() function on x86, which stops its search for active optimized probes when it encounters a disabled (disarmed) probe, rather than continuing past it. This means that when a new probe C is armed at address A+4, the function fails to detect that an active optkprobe at address A has already replaced five bytes (A through A+4) with a jump instruction (e9 d0 d1 d2 d3). The INT3 breakpoint (0xcc) inserted for probe C overwrites the last byte of A's jump displacement, corrupting the jump target and causing execution to branch to an arbitrary wrong address. The fix requires the kernel to skip disarmed and unprepared probes during overlap checking to correctly identify the active optimized probe. No CWE has been formally assigned, but the issue is consistent with improper state handling (CWE-754) in kernel instrumentation logic (GitHub Advisory, Feedly).

Successful exploitation allows a local attacker with the ability to register kprobes (typically requiring root or CAP_SYS_RESOURCE capability) to cause kernel execution to jump to an unintended memory address, potentially resulting in arbitrary kernel-level code execution, kernel panic, or system instability. Because the impact occurs at kernel privilege level, a successful exploit could compromise the entire system, including all processes and data. The scope is limited to the local system, but kernel-level code execution could facilitate privilege escalation or persistent access (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly, GitHub Advisory). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. Exploitation requires local access and elevated privileges (root or CAP_SYS_RESOURCE), significantly limiting the attacker pool. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

Apply the kernel patches that correct the get_optimized_kprobe() logic to skip disarmed and unprepared probes during overlap checking. Fixed versions are available at the following stable kernel commits: 985a568171e7 (6.12.x branch), 6745fa65f411 (6.18.x branch), 526fac219e8b (7.2.x branch), and 7a39c732a22e (7.3-rc6 and later). Stable release versions 6.12.113, 6.18.56, and 7.2.10 contain the fix (GitHub Advisory). As a workaround, restrict access to kprobe registration by enforcing strict capability controls (CAP_SYS_RESOURCE) and limiting which users or processes can load kernel modules or use the kprobes interface (Feedly).