HIGH Introduced in 7.2
bpf RhtabElement UAF
CVE-2026-98036
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve special fields in recycled rhtab elements rhtab_map_update_elem() initializes special fields after obtaining an element from bpf_mem_cache_alloc(). The allocator can return a fresh, zeroed unit, or recycle one from its RCU-pending lists before the registered destructor has run. A BPF program can retain a map-value pointer after deleting its element and initialize and arm a timer through that pointer. If the deleted unit is recycled, check_and_init_map_value() clears the only pointer to the timer. Neither a later deletion nor rhtab_mem_dtor() can then cancel it, and the callback can run with its key and value pointing into freed memory. Do not reinitialize special fields on insertion. Fresh allocator units are already zeroed. For recycled units, the special fields are ownership state that must remain visible to the eventual destructor. copy_map_value() already skips those fields, matching the non-preallocated hash-map path and the lifecycle established by commit 275c30bcee66 ("bpf: Don't reinit map value in prealloc_lru_pop"). [ kkd: Split out the fix and rewrote the commit log ]
02KernelScan AI Analysis
Risk summary
A BPF program interacting with resizable hashtable maps can trigger a use-after-free by retaining a map-value pointer after element deletion, arming a timer through it, and having the freed element recycled before the destructor runs. The timer callback then executes against freed memory, enabling kernel memory corruption, information disclosure, or a crash. This is reachable by any local user who can load BPF programs, which on configurations with unprivileged BPF enabled includes unprivileged container tenants.
Vulnerability analysis
When a BPF resizable hashtable element is deleted, the underlying memory may be recycled by the BPF memory allocator before the element's destructor has run. A BPF program can retain a pointer to the deleted element's value and arm a timer through it. On the next map update, the recycled unit is handed out and its special fields (including the timer pointer) are reinitialized, clearing the only reference the destructor needs to cancel that timer. The armed timer callback then fires with its key and value pointers referencing freed memory, producing a use-after-free. The fix removes the reinitialization of special fields on insertion—fresh allocator units are already zeroed, and recycled units must preserve those fields so the eventual destructor can still see and cancel any armed timer. The vulnerable path is reached through BPF map operations from a local process that can load BPF programs; on systems where unprivileged BPF is enabled, this includes unprivileged users and container tenants.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 7.2 | 7.2.7 | 6a5266b82882 |
| mainline | 7.2 | 7.3-rc2 | 5df46ddcb7b3 |