SB20261022482 - Use-after-free in Linux kernel trace

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-98861)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service through a potential kernel crash.

The vulnerability exists due to a use-after-free in the Linux kernel fprobe subsystem when handlers execute while RCU is not watching and their fprobe is freed after unregistration without waiting for those handlers to complete. A local privileged user can trigger overlapping handler execution and fprobe unregistration under these conditions to access freed kernel memory and potentially crash the kernel.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/a85d0f00671b4d4527317c10ba018680f7d8d673
• https://git.kernel.org/stable/c/dd4a0d4993633b45470abf6da4ea0ca563402245
• https://git.kernel.org/stable/c/e0a6249190402a28f1e2925a81acf573157d55ef