CVE-2026-98035: bpf: Cancel special fields when recycling rhtab elements
In the Linux kernel, the following vulnerability has been resolved:
bpf: Cancel special fields when recycling rhtab elements
rhtabmapupdateexisting() and rhtabdeleteelem() call bpfobjfreefields() when replacing or deleting a value. These map operations can run from BPF programs in NMI context, where releasing a referenced kptr or another complex field is not generally safe.
Array and hash maps avoid that problem by cancelling only the asynchronous fields which can be stopped safely in the caller context. Other ownership state remains attached to the allocation until its memory allocator destructor performs the final cleanup.
Use bpfobjcancelfields() for the corresponding rhtab paths as well. This cancels timers, workqueues, and task work while allowing rhtabmemdtor() to release referenced kptrs when the allocation is eventually destroyed.
[ kkd: Rebased, used direct helper calls, and rewrote the commit log ]
Affected Software
Event History
Frequently Asked Questions
What conditions are required for this issue to be reachable?
The affected replace and delete operations must be performed on an rhtab map from a BPF program running in NMI context. The problematic case involves map values containing referenced kptrs or other complex fields that require cleanup.
What is the immediate mitigation if an update cannot be applied?
Avoid performing rhtab map update-existing or delete operations from BPF programs executing in NMI context, particularly for values that contain referenced kptrs or other complex ownership-managed fields. The provided data does not identify a configuration-only fix.
What behavior does the fix change?
The corrected rhtab paths cancel timers, workqueues, and task work in the caller context rather than freeing all object fields there. Referenced kptrs remain attached to the allocation and are released later by the rhtab memory destructor.