CVE-2026-98378

Executive Summary

CVE-2026-98378 is a use‑after‑free (UAF) vulnerability in the Linux kernel BPF subsystem, specifically in the BPF link iterator (kernel/bpf/link_iter.c). The flaw allows a local attacker with the ability to create BPF links to trigger a dangling pointer reference when a link is freed before it is fully settled, leading to memory corruption. Successful exploitation can escalate privileges to kernel level, cause a kernel panic (denial of service), or potentially lead to arbitrary code execution in ring‑0. All systems running an unpatched Linux kernel that supports BPF link iteration are affected; no public exploit code or proof‑of‑concept is currently available.

Technical Analysis

The vulnerability resides in the interaction between BPF link creation and BPF link iteration. When a BPF link is created, bpf_link_prime() inserts the link into the link_idr (IDR) before anon_inode_getfile() has completed and before bpf_link_settle() publishes the link ID into link->id. During this transient window the link’s ID is zero (ID‑zero). The function bpf_link_by_id() correctly treats ID‑zero links as unsettled and refuses to operate on them. However, the link iterator (bpf_link_get_curr_or_next() invoked via bpf_link_seq_next) does not perform this check. It takes a reference to the link without verifying that the link is settled.

If anon_inode_getfile() subsequently fails, the creator removes the link ID and directly frees the still‑private link structure. The iterator, which had already taken a reference, is left pointing to freed memory. The next call to bpf_link_put() from the iterator then writes to this freed memory, resulting in a slab‑use‑after‑free. The kernel log in the description shows a KASAN report with the write of size 8 in bpf_link_put (kernel/bpf/syscall.c:3372), triggered through bpf_link_seq_next (kernel/bpf/link_iter.c:33), bpf_seq_read (kernel/bpf/bpf_iter.c:158), and finally a read system call. The panic occurs because panic_on_warn is set.

The root cause is a missing synchronization between the link creation path and the link iteration path. The iterator fails to treat ID‑zero entries as transient, exactly as bpf_link_by_id() does. This race window is narrow but reachable by a local attacker who can cause anon_inode_getfile() to fail (e.g., via resource exhaustion) while another thread iterates over BPF links.

Exploitation Scenarios

No public proof‑of‑concept or exploit code is available. The following attack chain is inferred from the vulnerability class (use‑after‑free) and the components named in the NVD description.

1. Reconnaissance / Target Identification: The attacker identifies a target system running an unpatched Linux kernel that exposes BPF link creation to unprivileged users (e.g., via unprivileged_bpf_disabled sysctl set to 0) or has a local user with CAP_BPF or CAP_SYS_ADMIN. Typical targets include container hosts, multi‑tenant cloud instances, and Linux workstations.

2. Triggering the Flaw Class: The attacker must create a race condition where a BPF link is inserted into the link_idr but anon_inode_getfile() fails before bpf_link_settle() publishes the ID. This requires precise timing. The attacker can orchestrate this by opening a large number of file descriptors or exhausting memory so that anon_inode_getfile() fails, while concurrently running a thread that iterates over BPF links (e.g., by reading from a BPF iterator file descriptor created via bpf_iter_create or a similar interface). The iterator will take a reference to the ID‑zero link.

3. Payload/Execution Method: After the creator frees the link (because anon_inode_getfile() failed), the iterator still holds a dangling reference. When the iterator advances or terminates, it calls bpf_link_put() on the freed link. The attacker cannot directly control the content of the freed memory without additional heap grooming, but a use‑after‑free in kernel memory can be leveraged to redirect execution or corrupt kernel data structures. At the vulnerability‑class level, this is a classic UAF that can be transformed into an arbitrary write or control‑flow hijack if the attacker can reclaim the freed slab with controlled data. The KASAN report shows the write occurs at bpf_link_put (syscall.c:3372), which writes to the link’s reference count or related fields.

4. Post‑Exploitation Impact: A successful exploit would allow the attacker to execute code in kernel context, leading to privilege escalation (e.g., gaining root privileges, disabling security modules, or escaping containers). Even without a full exploit, the UAF can cause a kernel panic, resulting in a denial of service. The blast radius is the entire kernel; all processes and data on the system are at risk.

Impact Assessment

The vulnerability is a local use‑after‑free in the Linux kernel BPF subsystem. The CVSS score is N/A, but based on the vulnerability class, a reasonable vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack with high complexity, requiring low privileges, and resulting in high confidentiality, integrity, and availability impact. The attack complexity is high because it depends on a narrow race window and the failure of anon_inode_getfile(). However, the impact is severe: kernel memory corruption can lead to privilege escalation (ring‑0 code execution), container escape, or a system crash. Affected systems include any Linux kernel that implements the BPF link iterator and does not contain the fix. This includes many enterprise Linux distributions, cloud kernels, and embedded systems. The lack of a public PoC does not diminish the risk, as advanced attackers may develop exploits. The EPSS score is not yet available, and the vulnerability is not listed in CISA KEV. No patch has been confirmed by the tracked sources, so all deployments remain vulnerable until an upstream kernel fix is applied.

Detection Guidance

Sigma Rule

title: Possible Linux Kernel BPF Link Iterator Use-After-Free Exploitation
id: 8a9b3c2e-1f4d-4e5a-9c7b-6d8e2f1a3b4c
status: experimental
description: Detects attempts to trigger CVE-2026-98378 by monitoring for repeated BPF link creation failures and BPF iterator operations.
author: Threat Intelligence
date: 2026-01-01
logsource:
  product: linux
  service: auditd
detection:
  selection_bpf:
    type: 'SYSCALL'
    syscall: 'bpf'
    a0: 'BPF_LINK_CREATE'
  selection_iter:
    type: 'SYSCALL'
    syscall: 'bpf'
    a0: 'BPF_ITER_CREATE'
  timeframe: 5m
  condition: selection_bpf and selection_iter | count() by exe > 10
fields:
  - exe
  - pid
  - uid
falsepositives:
  - Legitimate BPF monitoring tools
level: high

YARA Rule

rule CVE_2026_98378_BPF_Link_UAF
{
    meta:
        description = "Detects kernel crashes consistent with CVE-2026-98378 (BPF link iterator use-after-free)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-98378"
        hash = "unknown"
    strings:
        $kasan1 = "KASAN: slab-use-after-free in bpf_link_put" ascii wide
        $kasan2 = "bpf_link_seq_next" ascii wide
        $kasan3 = "bpf_seq_read" ascii wide
        $trace1 = "kernel/bpf/syscall.c:3372" ascii wide
        $trace2 = "kernel/bpf/link_iter.c:33" ascii wide
        $trace3 = "kernel/bpf/bpf_iter.c:158" ascii wide
    condition:
        any of ($kasan*) or 2 of ($trace*)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-98378 - Local BPF Link Iterator UAF Exploitation Attempt (no network vector)"; flow:to_server; content:"|7f 45 4c 46|"; depth:4; within:4; classtype:attempted-admin; sid:10000001; rev:1; metadata:created_at 2026_01_01, cve CVE_2026_98378;)

Note: This vulnerability is local; network rules are not directly applicable. The rule above is a placeholder for monitoring lateral movement of exploit binaries.

Elastic Detection

process where event.type == "start" and process.name in ("bpf", "bpftool", "perf") and
  process.args : ("*link*", "*iter*") and
  not process.parent.name in ("systemd", "init")

Splunk SPL Query

index=linux sourcetype=auditd type=SYSCALL syscall=bpf
| stats count by exe, uid, pid
| where count > 10
| table _time, exe, uid, pid, count

Wazuh OSSEC Rule

<group name="linux,bpf,">
  <rule id="100001" level="12">
    <decoded_as>auditd</decoded_as>
    <field name="audit.type">SYSCALL</field>
    <field name="audit.syscall">bpf</field>
    <field name="audit.exe">/usr/bin/bpftool</field>
    <description>CVE-2026-98378: Possible BPF link iterator UAF exploitation attempt via bpftool</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Restrict unprivileged BPF: set kernel.unprivileged_bpf_disabled=1 (or 2 for permanent) via sysctl to prevent unprivileged users from creating BPF links.
   • Remove CAP_BPF and CAP_SYS_ADMIN from untrusted users and containers.
   • Monitor kernel logs for KASAN reports containing bpf_link_put and bpf_link_seq_next; set panic_on_warn=0 to avoid automatic reboots while investigating.
   • Apply least‑privilege principles to services that rely on BPF (e.g., Cilium, Falco) and ensure they run with minimal capabilities.

2. Patch/Upgrade Steps:

   • No official patch is available from tracked sources. Monitor the Linux kernel mailing list and stable tree for a commit that modifies bpf_link_get_curr_or_next() in kernel/bpf/link_iter.c to skip ID‑zero links.
   • Once a patched kernel is released by your distribution, upgrade immediately. Reboot is required.
   • If using a custom kernel, backport the upstream fix that adds the ID‑zero check to the link iterator.

3. Long‑Term Hardening:

   • Keep unprivileged_bpf_disabled=1 unless BPF functionality is absolutely required for unprivileged processes.
   • Use mandatory access control (SELinux, AppArmor) to confine BPF usage to trusted binaries.
   • Enable kernel address space layout randomization (KASLR) and other exploit mitigations.
   • Regularly audit kernel versions and subscribe to security advisories for the Linux kernel and your distribution.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-98378
• Linux kernel BPF documentation: https://www.kernel.org/doc/html/latest/bpf/
• CWE‑416: https://cwe.mitre.org/data/definitions/416.html
• MITRE ATT&CK T1068: https://attack.mitre.org/techniques/T1068/
• CISA KEV: Not applicable (CVE not listed as of this report).