UBUNTU-CVE-2026-98378: Use After Free

In the Linux kernel, the following vulnerability has been resolved: bpf: Skip unsettled links in link iterator bpflinkprime() inserts a link into linkidr before anoninodegetfile() succeeds and before bpflinksettle() publishes the ID in link->id. bpflinkbyid() treats such an ID-zero link as unsettled, but the link iterator takes a reference without this check. If anoninodegetfile() then fails, the creator removes the ID and frees its still-private link directly. The iterator is left with a dangling reference and its next bpflinkput() accesses freed memory. Treat ID-zero entries as transient in bpflinkgetcurrornext(), just as bpflinkbyid() does. BUG: KASAN: slab-use-after-free in bpflinkput Write of size 8 by task exp/384 Call Trace: bpflinkput kernel/bpf/syscall.c:3372 bpflinkseqnext kernel/bpf/linkiter.c:33 bpfseqread kernel/bpf/bpfiter.c:158 vfsread fs/readwrite.c:572 ksysread fs/readwrite.c:716 dosyscall64 arch/x86/entry/syscall64.c:84 entrySYSCALL64afterhwframe arch/x86/entry/entry64.S:121 Kernel panic - not syncing: KASAN: paniconwarn set ...