SB20260928152 - Improper access control in Linux kernel bpf

Description

This security bulletin contains information about 1 vulnerability.

1) Improper access control (CVE-ID: CVE-2026-98047)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to improper enforcement of rbtree callback restrictions in the BPF verifier's in_rbtree_lock_required_cb() function when executing static subprogram calls from bpf_rbtree_add() comparator callbacks. A local user can release the root lock, remove and drop the node being compared, and relock the tree, causing native insertion to use stale pointers to freed memory.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2410cb2ac0416dd2795a81984c8c73d7250bd8c4
• https://git.kernel.org/stable/c/369f4ce734570bdfedaa4b5ca50e2a3f6a892728
• https://git.kernel.org/stable/c/b545fa447e09e6844868deb2bee228827fe54d15