SB20260928158 - Improper control of a resource through its lifetime in Linux kernel bpf

Description

This security bulletin contains information about 1 vulnerability.

1) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-98035)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger unsafe cleanup of complex BPF map fields.

The vulnerability exists due to improper resource cleanup in rhtab map element update and deletion operations when updating or deleting values from BPF programs in NMI context. A local user can update or delete an rhtab map value to trigger unsafe cleanup of complex BPF map fields.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/28fde1356dbc35e20a9f22a5ee65af09698fdf92
• https://git.kernel.org/stable/c/65cc95eba9e8b46312cac38c227473605a4b996a