CVE-2026-98642

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) memory allocator. A race condition occurs when bulk memory allocation and memory cleanup run concurrently without adequate synchronization. A local attacker could exploit this flaw to trigger a use-after-free condition, leading to a Denial of Service (DoS) via a system crash or potential privilege escalation.

A race in the BPF memory allocator allows alloc_bulk to consume waiting_for_gp_ttrace while an RCU Tasks Trace callback removes and frees the same list. The confirmed result is a use-after-free read of entry next in llist_del_first, which can cause a kernel crash and may propagate stale list state if the freed node is reused before the read. A related race can affect free_by_rcu_ttrace during allocator draining when IRQ work and cross-CPU frees overlap. For the CVSS the PR:L value is used because a local user or process with access to the BPF interface may create the required allocation and free activity. Systems that disable unprivileged BPF may require CAP_BPF or equivalent capabilities and therefore have lower practical exposure. AC:H is used because successful triggering depends on a concurrent timing window involving RCU callbacks and list consumption. The issue is not directly network reachable. Impact is at least a local denial of service via kernel crash and in the paranoid case may include confidentiality and integrity impact due to reuse of a freed list node and possible allocator state corruption. Privilege escalation is plausible as a worst-case consequence of the memory corruption class but is not demonstrated by the available evidence.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.