CVE-2026-98384: Linux Kernel Use-After-Free Vulnerability

CVE-2026-98384 Overview

CVE-2026-98384 is an out-of-bounds read vulnerability in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. The flaw lives in bpf_sock_destroy(), which reads the sk_protocol field without first verifying the socket type. The TCP iterator can hand bpf_sock_destroy() a TIME_WAIT or NEW_SYN_RECV socket, neither of which is a full struct sock. Because sk_protocol lives in struct sock rather than struct sock_common, the read runs past the object boundary. Kernel Address Sanitizer (KASAN) flags this as a slab-out-of-bounds read of two bytes, confirming memory corruption potential during BPF iterator execution.

Critical Impact
An unprivileged process invoking the TCP BPF iterator can trigger a kernel heap out-of-bounds read, risking information disclosure or kernel instability.

Affected Products

Linux kernel versions containing the bpf_sock_destroy() kfunc with the TCP iterator path
Distributions shipping affected upstream stable kernels prior to the referenced fix commits
Systems where unprivileged BPF or TCP socket iteration is permitted

Discovery Timeline

2026-10-09 - CVE-2026-98384 published to the National Vulnerability Database
2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-98384

Vulnerability Analysis

The Linux kernel exposes bpf_sock_destroy() as a kfunc that BPF programs invoke from the TCP socket iterator. The function reads sk->sk_protocol to decide how to tear down the socket. The TCP iterator, however, can present three socket shapes: full sockets (struct sock), time-wait sockets (struct inet_timewait_sock), and request sockets (struct request_sock). Only the first embeds sk_protocol; the other two embed only struct sock_common.

When the iterator passes a time-wait or request socket, dereferencing sk_protocol reads memory beyond the allocated slab object. KASAN confirms the overread with a slab-out-of-bounds report of two bytes at offset corresponding to sk_protocol. The leaked bytes come from adjacent slab metadata or neighboring allocations, which can expose kernel pointers useful for defeating Kernel Address Space Layout Randomization (KASLR).

Root Cause

The root cause is a missing socket-state check before accessing a field that only exists on full sockets. The original code assumed every socket handed to bpf_sock_destroy() was a full struct sock. The comment preceding the check was also inaccurate and never reflected what the code actually did.

Attack Vector

Triggering the bug requires loading a BPF iterator program over TCP sockets and calling bpf_sock_destroy() on each socket returned. The iterator naturally yields time-wait and request sockets alongside established ones, so no special targeting is needed. The fix restricts the sk_protocol read to full sockets and relies on tcp_abort() to handle TIME_WAIT and NEW_SYN_RECV sockets correctly.

No public exploit code or proof-of-concept targeting CVE-2026-98384 is listed in the available references. Readers should consult the upstream commits for the exact patched code.

Detection Methods for CVE-2026-98384

Indicators of Compromise

KASAN reports containing slab-out-of-bounds in bpf_sock_destroy in kernel logs on debug builds
Kernel oops or warning traces referencing bpf_iter_tcp_seq_show and bpf_sock_destroy
Unexpected loading of BPF iterator programs by non-root or lightly privileged workloads

Detection Strategies

Audit bpf() syscall telemetry for BPF_PROG_LOAD operations with program type BPF_PROG_TYPE_TRACING attaching to tcp or tcp6 iterators
Correlate reads from /sys/fs/bpf/ iterator pins and bpf_iter file descriptors with the invoking process identity
Alert on repeated kernel KASAN or BUG: entries referencing network stack functions from unprivileged user contexts

Monitoring Recommendations

Ingest /var/log/kern.log and dmesg output into a central log pipeline and search for the signature bpf_sock_destroy+
Track kernel versions across the fleet and flag hosts running pre-patch builds that also expose BPF to unprivileged users
Monitor for new or unexpected eBPF programs through audit subsystem rules on the bpf syscall

How to Mitigate CVE-2026-98384

Immediate Actions Required

Apply the upstream kernel fix referenced by commits 01b245b, 2534a5e, 5b4eb82, 91a482a, and a965170 as soon as distribution packages are available
Set kernel.unprivileged_bpf_disabled=1 to prevent unprivileged users from loading BPF programs on hosts that do not require this capability
Restrict CAP_BPF and CAP_NET_ADMIN to trusted service accounts only

Patch Information

The fix limits the sk_protocol read to full sockets and defers TIME_WAIT and NEW_SYN_RECV handling to tcp_abort(), which already understands those socket states. Patched sources are available from the upstream stable tree: Kernel Commit 01b245b, Kernel Commit 2534a5e, Kernel Commit 5b4eb82, Kernel Commit 91a482a, and Kernel Commit a965170.

Workarounds

Disable unprivileged BPF globally with the kernel.unprivileged_bpf_disabled sysctl until the kernel is updated
Remove or restrict BPF iterator pins under /sys/fs/bpf/ that non-administrative users can open
Where feasible, build and run with Lockdown mode enabled to reduce the attack surface of BPF tracing features

bash

# Configuration example: disable unprivileged BPF persistently
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/90-bpf-hardening.conf
sudo sysctl --system

# Verify current kernel setting
sysctl kernel.unprivileged_bpf_disabled