---
id: CVE-2026-98813
title: 'bpf: Hold map BTF for the memory allocator destructor record'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Hold map BTF for the memory allocator destructor record

  bpf_ma_set_dtor() duplicates map->record so that the bpf_mem_alloc
  destructor can release the special fiel…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1df97a7453eec80c1912c2d0360290a3970a7671 <
    b506f5699e145196ee29d76cf1ca1cbb2202c055
  - >-
    Linux >= 1df97a7453eec80c1912c2d0360290a3970a7671 <
    ab39974240a0cff765f3bb9cce81d8001ffdb144
  - Linux 451a84a3ad3c897c03181af433e7c98640730f1f
  - Linux 51a17f0ce19c4ee2a25cf16c93490d509b1ebb0a
  - Linux >= 6.12.112 < 6.13
  - Linux >= 6.18.55 < 6.19
  - Linux 7.0
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:48:59.745Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98813'
references:
  - url: 'https://git.kernel.org/stable/c/b506f5699e145196ee29d76cf1ca1cbb2202c055'
  - url: 'https://git.kernel.org/stable/c/ab39974240a0cff765f3bb9cce81d8001ffdb144'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.477Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: Hold map BTF for the memory allocator destructor record

bpf_ma_set_dtor() duplicates map->record so that the bpf_mem_alloc
destructor can release the special fields of hash and rhash map elements
once the allocator frees them for good. btf_record_dup() only acquires
references on kernel and module BTF. Fields whose types live in the map
BTF keep pointing into it: a kptr to a local type refers to map->btf,
and a list_head or rb_root field carries a value_rec owned by the struct
meta table of map->btf.

That borrowed state can outlive the map. When RCU callbacks are still in
flight, bpf_mem_alloc_destroy() copies the allocator and defers the final
drain, together with the destructor context, to a workqueue.
bpf_map_free() then frees map->record and drops the map's BTF reference
as soon as map_free() returns. Once the program that loaded the BTF is
gone as well, the BTF is freed while the worker still uses the
duplicate. The worker dereferences it through btf_is_kernel() and
btf_find_struct_meta() in bpf_obj_free_fields() when destroying elements
that were freed under RCU, and through btf_is_kernel() in
btf_record_free() when releasing the context itself:

  BUG: KASAN: slab-use-after-free in btf_is_kernel+0x19/0x30
  Read of size 1 at addr ffff88811505dce8 by task kworker/u16:2/50
  Workqueue: events_unbound free_mem_alloc_deferred
  Call Trace:
   btf_is_kernel+0x19/0x30
   btf_record_free+0xc7/0xf0
   htab_dtor_ctx_free+0x1a/0x30
   free_mem_alloc_no_barrier+0x39/0x230
   free_mem_alloc_deferred+0x2a/0x40
   process_scheduled_works+0x5ce/0x9d0
   worker_thread+0x42a/0x5e0
   kthread+0x1f5/0x230
   ret_from_fork+0x1dd/0x390
   ret_from_fork_asm+0x1a/0x30

  Allocated by task 358:
   __kmalloc_cache_noprof+0x287/0x510
   btf_new_fd+0xf7/0x3d0
   __sys_bpf+0x487/0x840

  Freed by task 0:
   kfree+0x186/0x560
   rcu_core+0x6f6/0xd40

Freeing a map that still holds more elements than the allocator's high
watermark is enough to get there, because the bulk free during teardown
queues the RCU callback that makes bpf_mem_alloc_destroy() defer.
Non-preallocated hash maps and resizable hash maps both register the
destructor and are affected alike.

Keep one reference on the map BTF in the destructor context. Every
non-kernel pointer in the duplicated record is either map->btf or memory
owned by it, so a single reference covers kptrs, list heads, and rb
roots, and mirrors what bpf_map_meta_alloc() does for the duplicated
record of an inner map. Release it only after the duplicated record has
been freed: the worker is preemptible and not in an RCU read-side
critical section, so dropping the last reference first would let the
BTF be freed while btf_record_free() still reads its fields.

## Affected

- `Linux >= 1df97a7453eec80c1912c2d0360290a3970a7671 < b506f5699e145196ee29d76cf1ca1cbb2202c055`
- `Linux >= 1df97a7453eec80c1912c2d0360290a3970a7671 < ab39974240a0cff765f3bb9cce81d8001ffdb144`
- `Linux 451a84a3ad3c897c03181af433e7c98640730f1f`
- `Linux 51a17f0ce19c4ee2a25cf16c93490d509b1ebb0a`
- `Linux >= 6.12.112 < 6.13`
- `Linux >= 6.18.55 < 6.19`
- `Linux 7.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.