CVE-2026-98060

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the BPF rbtree implementation where the bpf rbtree add() function maintains parent and link pointers across calls to a program-supplied comparison callback. The verifier requires the root lock to be held during this process. While this is enforced for bpf spin lock() and bpf spin unlock(), it is not enforced for the resilient lock kfunc argument path. This allows a callback to release the root lock, potentially enabling another CPU to remove and free the node being referenced during the tree walk, leading to the use of freed pointers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.