CVE-2026-98813: bpf: Hold map BTF for the memory allocator destructor record
In the Linux kernel, the following vulnerability has been resolved:
bpf: Hold map BTF for the memory allocator destructor record
bpfmasetdtor() duplicates map->record so that the bpfmemalloc destructor can release the special fields of hash and rhash map elements once the allocator frees them for good. btfrecorddup() only acquires references on kernel and module BTF. Fields whose types live in the map BTF keep pointing into it: a kptr to a local type refers to map->btf, and a listhead or rbroot field carries a valuerec owned by the struct meta table of map->btf.
That borrowed state can outlive the map. When RCU callbacks are still in flight, bpfmemallocdestroy() copies the allocator and defers the final drain, together with the destructor context, to a workqueue. bpfmapfree() then frees map->record and drops the map's BTF reference as soon as mapfree() returns. Once the program that loaded the BTF is gone as well, the BTF is freed while the worker still uses the duplicate. The worker dereferences it through btfiskernel() and btffindstructmeta() in bpfobjfreefields() when destroying elements that were freed under RCU, and through btfiskernel() in btfrecordfree() when releasing the context itself:
BUG: KASAN: slab-use-after-free in btfiskernel+0x19/0x30 Read of size 1 at addr ffff88811505dce8 by task kworker/u16:2/50 Workqueue: eventsunbound freememallocdeferred Call Trace: btfiskernel+0x19/0x30 btfrecordfree+0xc7/0xf0 htabdtorctxfree+0x1a/0x30 freememallocnobarrier+0x39/0x230 freememallocdeferred+0x2a/0x40 processscheduledworks+0x5ce/0x9d0 workerthread+0x42a/0x5e0 kthread+0x1f5/0x230 retfromfork+0x1dd/0x390 retfromforkasm+0x1a/0x30
Allocated by task 358: kmalloccachenoprof+0x287/0x510 btfnewfd+0xf7/0x3d0 sysbpf+0x487/0x840
Freed by task 0: kfree+0x186/0x560 rcucore+0x6f6/0xd40
Freeing a map that still holds more elements than the allocator's high watermark is enough to get there, because the bulk free during teardown queues the RCU callback that makes bpfmemallocdestroy() defer. Non-preallocated hash maps and resizable hash maps both register the destructor and are affected alike.
Keep one reference on the map BTF in the destructor context. Every non-kernel pointer in the duplicated record is either map->btf or memory owned by it, so a single reference covers kptrs, list heads, and rb roots, and mirrors what bpfmapmetaalloc() does for the duplicated record of an inner map. Release it only after the duplicated record has been freed: the worker is preemptible and not in an RCU read-side critical section, so dropping the last reference first would let the BTF be freed while btfrecordfree() still reads its fields.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Keep one reference on the map BTF in the destructor context: have bpf_ma_set_dtor() duplicate map->record while retaining the map BTF reference, and release that reference only after the duplicated record has been freed.
Event History
Frequently Asked Questions
What conditions are needed to trigger the use-after-free?
The affected path requires BPF map fields whose types are backed by map-specific BTF, such as a kptr to a local type or list_head/rb_root fields with metadata owned by the map BTF. It also requires RCU callbacks to remain in flight so allocator destruction is deferred to a workqueue after the map and its BTF reference are released.
When does the stale BTF state get accessed?
The deferred worker can access the duplicate destructor record while destroying elements freed under RCU. The described accesses occur in bpf_obj_free_fields() through btf_is_kernel() and btf_find_struct_meta().
How can affected code be remediated?
Apply a Linux kernel update containing either referenced stable commit b506f5699e145196ee29d76cf1ca1cbb2202c055 or ab39974240a0cff765f3bb9cce81d8001ffdb144. The fix holds the map BTF for the allocator destructor record so it remains valid until deferred cleanup completes.