UBUNTU-CVE-2026-98813: Use After Free

In the Linux kernel, the following vulnerability has been resolved: bpf: Hold map BTF for the memory allocator destructor record bpfmasetdtor() duplicates map->record so that the bpfmemalloc destructor can release the special fields of hash and rhash map elements once the allocator frees them for good. btfrecorddup() only acquires references on kernel and module BTF. Fields whose types live in the map BTF keep pointing into it: a kptr to a local type refers to map->btf, and a listhead or rbroot field carries a valuerec owned by the struct meta table of map->btf. That borrowed state can outlive the map. When RCU callbacks are still in flight, bpfmemallocdestroy() copies the allocator and defers the final drain, together with the destructor context, to a workqueue. bpfmapfree() then frees map->record and drops the map's BTF reference as soon as mapfree() returns. Once the program that loaded the BTF is gone as well, the BTF is freed while the worker still uses the duplicate. The worker dereferences it through btfiskernel() and btffindstructmeta() in bpfobjfreefields() when destroying elements that were freed under RCU, and through btfiskernel() in btfrecordfree() when releasing the context itself: BUG: KASAN: slab-use-after-free in btfiskernel+0x19/0x30 Read of size 1 at addr ffff88811505dce8 by task kworker/u16:2/50 Workqueue: eventsunbound freememallocdeferred Call Trace: btfiskernel+0x19/0x30 btfrecordfree+0xc7/0xf0 htabdtorctxfree+0x1a/0x30 freememallocnobarrier+0x39/0x230 freememallocdeferred+0x2a/0x40 processscheduledworks+0x5ce/0x9d0 workerthread+0x42a/0x5e0 kthread+0x1f5/0x230 retfromfork+0x1dd/0x390 retfromforkasm+0x1a/0x30 Allocated by task 358: kmalloccachenoprof+0x287/0x510 btfnewfd+0xf7/0x3d0 sysbpf+0x487/0x840 Freed by task 0: kfree+0x186/0x560 rcucore+0x6f6/0xd40 Freeing a map that still holds more elements than the allocator's high watermark is enough to get there, because the bulk free during teardown queues the RCU callback that makes bpfmemallocdestroy() defer. Non-preallocated hash maps and resizable hash maps both register the destructor and are affected alike. Keep one reference on the map BTF in the destructor context. Every non-kernel pointer in the duplicated record is either map->btf or memory owned by it, so a single reference covers kptrs, list heads, and rb roots, and mirrors what bpfmapmetaalloc() does for the duplicated record of an inner map. Release it only after the duplicated record has been freed: the worker is preemptible and not in an RCU read-side critical section, so dropping the last reference first would let the BTF be freed while btfrecordfree() still reads its fields.