{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.10-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  bpf: Hold map BTF for the memory allocator destructor record  bpf_ma_set_dtor() duplicates map-\u003erecord so that the bpf_mem_alloc destructor can release the special fields of hash and rhash map elements once the allocator frees them for good. btf_record_dup() only acquires references on kernel and module BTF. Fields whose types live in the map BTF keep pointing into it: a kptr to a local type refers to map-\u003ebtf, and a list_head or rb_root field carries a value_rec owned by the struct meta table of map-\u003ebtf.  That borrowed state can outlive the map. When RCU callbacks are still in flight, bpf_mem_alloc_destroy() copies the allocator and defers the final drain, together with the destructor context, to a workqueue. bpf_map_free() then frees map-\u003erecord and drops the map's BTF reference as soon as map_free() returns. Once the program that loaded the BTF is gone as well, the BTF is freed while the worker still uses the duplicate. The worker dereferences it through btf_is_kernel() and btf_find_struct_meta() in bpf_obj_free_fields() when destroying elements that were freed under RCU, and through btf_is_kernel() in btf_record_free() when releasing the context itself:    BUG: KASAN: slab-use-after-free in btf_is_kernel+0x19/0x30   Read of size 1 at addr ffff88811505dce8 by task kworker/u16:2/50   Workqueue: events_unbound free_mem_alloc_deferred   Call Trace:    btf_is_kernel+0x19/0x30    btf_record_free+0xc7/0xf0    htab_dtor_ctx_free+0x1a/0x30    free_mem_alloc_no_barrier+0x39/0x230    free_mem_alloc_deferred+0x2a/0x40    process_scheduled_works+0x5ce/0x9d0    worker_thread+0x42a/0x5e0    kthread+0x1f5/0x230    ret_from_fork+0x1dd/0x390    ret_from_fork_asm+0x1a/0x30    Allocated by task 358:    __kmalloc_cache_noprof+0x287/0x510    btf_new_fd+0xf7/0x3d0    __sys_bpf+0x487/0x840    Freed by task 0:    kfree+0x186/0x560    rcu_core+0x6f6/0xd40  Freeing a map that still holds more elements than the allocator's high watermark is enough to get there, because the bulk free during teardown queues the RCU callback that makes bpf_mem_alloc_destroy() defer. Non-preallocated hash maps and resizable hash maps both register the destructor and are affected alike.  Keep one reference on the map BTF in the destructor context. Every non-kernel pointer in the duplicated record is either map-\u003ebtf or memory owned by it, so a single reference covers kptrs, list heads, and rb roots, and mirrors what bpf_map_meta_alloc() does for the duplicated record of an inner map. Release it only after the duplicated record has been freed: the worker is preemptible and not in an RCU read-side critical section, so dropping the last reference first would let the BTF be freed while btf_record_free() still reads its fields.",
  "id": "DEBIAN-CVE-2026-98813",
  "modified": "2026-10-19T04:47:34.959778529Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-98813"
    }
  ],
  "upstream": [
    "CVE-2026-98813"
  ]
}