CVE-2026-98047

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the BPF subsystem where the in rbtree lock required cb() function only checks the innermost verifier frame. When bpf rbtree add() invokes its comparator while holding the root lock, the verifier is supposed to prohibit unlocking, consuming tree nodes, or changing RCU (Read-Copy-Update) state. However, static subprogram calls push a new frame without the in callback fn set, causing these restrictions to disappear in the nested frame. This allows a subprogram to unlock the tree, remove and drop the node being compared, and then relock. The native insertion then resumes using a stale parent pointer, which links freed memory into the tree.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.