CVE-2026-98813

In the Linux kernel, the following vulnerability has been resolved:

bpf: Hold map BTF for the memory allocator destructor record

bpf ma set dtor() duplicates map->record so that the bpf mem alloc destructor can release the special fields of hash and rhash map elements once the allocator frees them for good. btf record dup() only acquires references on kernel and module BTF. Fields whose types live in the map BTF keep pointing into it: a kptr to a local type refers to map->btf, and a list head or rb root field carries a value rec owned by the struct meta table of map->btf.

That borrowed state can outlive the map. When RCU callbacks are still in flight, bpf mem alloc destroy() copies the allocator and defers the final drain, together with the destructor context, to a workqueue. bpf map free() then frees map->record and drops the map's BTF reference as soon as map free() returns. Once the program that loaded the BTF is gone as well, the BTF is freed while the worker still uses the duplicate. The worker dereferences it through btf is kernel() and btf find struct meta() in bpf obj free fields() when destroying elements that were freed under RCU, and through btf is kernel() in btf record free() when releasing the context itself:

BUG: KASAN: slab-use-after-free in btf is kernel+0x19/0x30 Read of size 1 at addr ffff88811505dce8 by task kworker/u16:2/50 Workqueue: events unbound free mem alloc deferred Call Trace: btf is kernel+0x19/0x30 btf record free+0xc7/0xf0 htab dtor ctx free+0x1a/0x30 free mem alloc no barrier+0x39/0x230 free mem alloc deferred+0x2a/0x40 process scheduled works+0x5ce/0x9d0 worker thread+0x42a/0x5e0 kthread+0x1f5/0x230 ret from fork+0x1dd/0x390 ret from fork asm+0x1a/0x30

Allocated by task 358: kmalloc cache noprof+0x287/0x510 btf new fd+0xf7/0x3d0 sys bpf+0x487/0x840

Freed by task 0: kfree+0x186/0x560 rcu core+0x6f6/0xd40

Freeing a map that still holds more elements than the allocator's high watermark is enough to get there, because the bulk free during teardown queues the RCU callback that makes bpf mem alloc destroy() defer. Non-preallocated hash maps and resizable hash maps both register the destructor and are affected alike.

Keep one reference on the map BTF in the destructor context. Every non-kernel pointer in the duplicated record is either map->btf or memory owned by it, so a single reference covers kptrs, list heads, and rb roots, and mirrors what bpf map meta alloc() does for the duplicated record of an inner map. Release it only after the duplicated record has been freed: the worker is preemptible and not in an RCU read-side critical section, so dropping the last reference first would let the BTF be freed while btf record free() still reads its fields.