Use-After-Free Vulnerability in Linux Kernel Due to fprobe Handler Execution Timing

CVE-2026-98861

What is CVE-2026-98861?

A vulnerability in the Linux kernel arises from incorrect handling during the unregistration of fprobe handlers, particularly when RCU is not actively monitoring. This can potentially lead to a use-after-free condition if an fprobe handler finishes execution while not being tracked by standard RCU grace periods. This situation occurs typically in idle states or certain quiescent conditions. By modifying the handling to check for RCU state properly, it ensures that operations finish safely without risking freeing the associated resources prematurely. The implementation of guard functions enhances performance and safety by minimizing overhead and preventing lockdep recursion errors.

References