---
id: CVE-2026-98047
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Check ancestor frames for rbtree callbacks

  bpf_rbtree_add() invokes its comparator while the caller holds the root
  lock
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Check ancestor frames for rbtree callbacks

  bpf_rbtree_add() invokes its comparator while the caller holds the root
  lock. The native insertion code retains raw par…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a44b1334aadd82203f661adb9adb41e53ad0e8d1 <
    b545fa447e09e6844868deb2bee228827fe54d15
  - >-
    Linux >= a44b1334aadd82203f661adb9adb41e53ad0e8d1 <
    2410cb2ac0416dd2795a81984c8c73d7250bd8c4
  - >-
    Linux >= a44b1334aadd82203f661adb9adb41e53ad0e8d1 <
    369f4ce734570bdfedaa4b5ca50e2a3f6a892728
  - Linux 6.9
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T11:17:33.553'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98047'
references:
  - url: 'https://git.kernel.org/stable/c/2410cb2ac0416dd2795a81984c8c73d7250bd8c4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/369f4ce734570bdfedaa4b5ca50e2a3f6a892728'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b545fa447e09e6844868deb2bee228827fe54d15'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T11:06:38.847Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: Check ancestor frames for rbtree callbacks

bpf_rbtree_add() invokes its comparator while the caller holds the root
lock. The native insertion code retains raw parent and link pointers across
the callback, so the verifier prohibits unlocking, consuming tree nodes,
or changing RCU state from that callback.

in_rbtree_lock_required_cb() only checks the innermost verifier frame.
Static subprogram calls are permitted while holding a spin lock, and such a
call pushes a frame without in_callback_fn set. Consequently, all callback
restrictions disappear in the nested frame. The subprogram can unlock the
tree, remove and drop the node being compared, then relock. Native insertion
resumes with the stale parent pointer and links freed memory into the tree.

Walk all active frames for the rbtree callback instead. Benign static
subprograms remain permitted, while callback restrictions follow execution
into nested frames.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.