{"cve":"CVE-2026-98035","nvd":{"published":"2026-09-25T11:17:32.237","modified":"2026-10-19T10:17:57.480","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Cancel special fields when recycling rhtab elements\n\nrhtab_map_update_existing() and rhtab_delete_elem() call\nbpf_obj_free_fields() when replacing or deleting a value. These map\noperations can run from BPF programs in NMI context, where releasing a\nreferenced kptr or another complex field is not generally safe.\n\nArray and hash maps avoid that problem by cancelling only the asynchronous\nfields which can be stopped safely in the caller context. Other ownership\nstate remains attached to the allocation until its memory allocator\ndestructor performs the final cleanup.\n\nUse bpf_obj_cancel_fields() for the corresponding rhtab paths as well. This\ncancels timers, workqueues, and task work while allowing rhtab_mem_dtor() to\nrelease referenced kptrs when the allocation is eventually destroyed.\n\n[ kkd: Rebased, used direct helper calls, and rewrote the commit log ]","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/28fde1356dbc35e20a9f22a5ee65af09698fdf92","https://git.kernel.org/stable/c/65cc95eba9e8b46312cac38c227473605a4b996a"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:56:02.509636177+00:00"},"epss":{"cve":"CVE-2026-98035","score":0.00155,"percentile":0.04616,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}