CVE-2026-98861: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-98861 is a use-after-free vulnerability in the Linux kernel's fprobe subsystem, affecting the unregistration path of function probes used by BPF kprobe-multi operations. The flaw arises when unregister_fprobe() or unregister_fprobe_async() free an fprobe while in-flight handlers are still executing in RCU quiescent states (e.g., idle loop or nohz_full extended quiescent states), where standard RCU grace periods do not track execution. Affected Linux kernel versions include 6.18.34 through 6.18.56 (exclusive) and 7.0.11 through 7.1. The vulnerability was published on October 18, 2026, with a patch available on the same date. Feedly estimates the severity as HIGH (GitHub Advisory, Kernel CVE Announce).

The root cause is a race condition / use-after-free (CWE-416) in the Linux kernel fprobe subsystem. unregister_fprobe() and unregister_fprobe_async() rely on synchronize_rcu() and call_rcu() to wait for in-flight handlers before freeing the fprobe structure. However, when an fprobe handler executes while RCU is not watching — such as during CPU idle or nohz_full extended quiescent states — standard RCU does not track preemption-disabled sections, so synchronize_rcu() returns prematurely and the fprobe can be freed while still in use. Additionally, fprobe_fgraph_entry() and fprobe_ftrace_entry() previously used guard(rcu)() and rcu_read_lock(), which invoke lockdep on every probe hit under CONFIG_PROVE_LOCKING, adding overhead and risking lockdep recursion. The fix introduces guard(rcu_sched_notrace)() and an rcu_is_watching() check to ensure handlers exit early when RCU is not watching, eliminating the race (GitHub Advisory).

A local user with the ability to load and unload kernel probes — or perform BPF kprobe-multi operations — can trigger the use-after-free condition, potentially achieving arbitrary kernel code execution or causing a kernel crash (denial of service). Successful exploitation could grant an attacker full kernel-level privileges, enabling complete system compromise, privilege escalation from a local unprivileged context, and potential lateral movement within the affected host. Data confidentiality and integrity are both at risk if kernel code execution is achieved (GitHub Advisory, Kernel CVE Announce).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the publication date (GitHub Advisory). Exploitation requires local access and the ability to load kernel probes or perform BPF kprobe-multi operations, which limits the attack surface to privileged or specially-capable local users. No threat actor attribution has been reported, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. EPSS score data is not yet available for this CVE.

Update the Linux kernel to a patched version: 6.18.56 or later for the 6.18.x stable series, or 7.1 (with the fix applied) / 7.2.10 or later for the 7.x series. The upstream fixes are available at the following stable kernel commits: a85d0f00671b4d4527317c10ba018680f7d8d673, dd4a0d4993633b45470abf6da4ea0ca563402245, and e0a6249190402a28f1e2925a81acf573157d55ef. As interim workarounds, restrict access to kernel probe loading and BPF operations to trusted users only (e.g., via CAP_SYS_ADMIN or CAP_BPF restrictions), and disable fprobe or BPF kprobe-multi functionality if not operationally required (GitHub Advisory, Kernel CVE Announce).