{"id":"CVE-2026-98378","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Skip unsettled links in link iterator\n\nbpf_link_prime() inserts a link into link_idr before anon_inode_getfile()\nsucceeds and before bpf_link_settle() publishes th…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Skip unsettled links in link iterator\n\nbpf_link_prime() inserts a link into link_idr before anon_inode_getfile()\nsucceeds and before bpf_link_settle() publishes th…","severity":"high","published":"2026-10-09","updated":"2026-10-09","sourceUpdated":"2026-10-09T08:16:56.123","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98378","references":[{"url":"https://git.kernel.org/stable/c/50e80e2bb5e2be8515205b9c496b9640ddefa434","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/68930f8d40ab4c10ca3b019f076136758fd100a8","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e271f093d15d323f42de26f66556af53fa8e19f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/798a61edbc436cacdb659927d067368eeb1e30e2","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/87ce4b53b7436b50fc984f0a6afaf77f68ac5573","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c251ed48bd9063cf7de6049421e78b6de989060f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98378.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-98378"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548398"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98378"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98378"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98378.mbox"}],"tags":["nvd","csaf","vex","red-hat","cve.org"],"ingestedAt":"2026-10-09T08:29:41.350Z","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","affected":["enterprise_linux 10","enterprise_linux 9","openshift_container_platform 4"],"cvss":7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"vendor","cwe":["CWE-825"],"epss":0.00117,"epssPercentile":0.01651,"scores":{"vendor":7,"cna":7.8},"slug":"CVE-2026-98378","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Skip unsettled links in link iterator\n\nbpf_link_prime() inserts a link into link_idr before anon_inode_getfile()\nsucceeds and before bpf_link_settle() publishes the ID in link->id.\nbpf_link_by_id() treats such an ID-zero link as unsettled, but the link\niterator takes a reference without this check.\n\nIf anon_inode_getfile() then fails, the creator removes the ID and frees\nits still-private link directly.  The iterator is left with a dangling\nreference and its next bpf_link_put() accesses freed memory.\n\nTreat ID-zero entries as transient in bpf_link_get_curr_or_next(), just as\nbpf_link_by_id() does.\n\n  BUG: KASAN: slab-use-after-free in bpf_link_put\n  Write of size 8 by task exp/384\n  Call Trace:\n  bpf_link_put                    kernel/bpf/syscall.c:3372\n  bpf_link_seq_next               kernel/bpf/link_iter.c:33\n  bpf_seq_read                    kernel/bpf/bpf_iter.c:158\n  vfs_read                        fs/read_write.c:572\n  ksys_read                       fs/read_write.c:716\n  do_syscall_64                   arch/x86/entry/syscall_64.c:84\n  entry_SYSCALL_64_after_hwframe  arch/x86/entry/entry_64.S:121\n  Kernel panic - not syncing: KASAN: panic_on_warn set ...\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98378.json)","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":38.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":219117,"id":"CVE-2026-98378","ts":1791707066166,"field":"cvss","old":null,"new":"7"},{"seq":219116,"id":"CVE-2026-98378","ts":1791707066166,"field":"severity","old":"none","new":"high"}]}