CVE-2026-98856: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-98856 Overview

CVE-2026-98856 is a Linux kernel vulnerability in the kprobes subsystem. The flaw affects how get_optimized_kprobe() handles disarmed probes when checking for optimized kprobe (optkprobe) overlap on x86 systems. An optkprobe at address A replaces five bytes with a jump instruction. If a disabled probe exists within that five-byte window, the overlap check stops prematurely, allowing a new probe to overwrite part of the original jump displacement. Execution can then transfer to an incorrect address, destabilizing the kernel.

Critical Impact
An INT3 breakpoint can overwrite a byte of an active optimized probe's jump displacement, redirecting kernel execution to an unintended address and potentially causing kernel instability or crashes.

Affected Products

Linux kernel on x86 architectures using the kprobes and optkprobes subsystem
Stable kernel branches referenced in upstream commits 3f968dcd, 526fac21, 6745fa65, 7a39c732, and 985a5681
Distributions shipping kernels prior to the merged fix

Discovery Timeline

2026-10-18 - CVE-2026-98856 published to the National Vulnerability Database
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98856

Vulnerability Analysis

The kprobes subsystem allows runtime instrumentation of kernel code. On x86, an optimized kprobe at address A installs a 5-byte relative jump (e9 d0 d1 d2 d3) covering bytes A through A+4. When a new probe is armed at an address inside this window, the kernel must detect the overlap and unoptimize the existing probe first.

The routine get_optimized_kprobe() walks probes to locate the active optimized probe. The defect is that this walk stops at a disabled probe. If a disarmed probe B sits at A+2 and a new probe C is armed at A+4, the lookup terminates at B and never reaches A. The kernel then installs the INT3 (cc) breakpoint for C on top of the last byte of A's jump displacement, corrupting the jump target.

Root Cause

The root cause is incorrect iteration logic in the optimized-probe overlap check. The function treated any probe found within the 5-byte region as authoritative, including probes that are disarmed and have no active jump to unoptimize. A disarmed probe may have prepared optinsns but holds no live jump, so it should not short-circuit the search for the actually optimized probe.

Attack Vector

Exploitation requires the ability to register and manipulate kprobes, which demands CAP_SYS_ADMIN and kernel tracing privileges. The condition triggers when at least two probes are placed within a 5-byte window of an optimized probe and one of them is disabled before another is armed. The resulting corruption of the jump displacement can direct kernel execution to an unintended address, producing undefined behavior, kernel panics, or memory corruption rather than a direct remote-exploitable condition.

No verified exploitation code is publicly available. See the upstream kernel commit for the complete fix.

Detection Methods for CVE-2026-98856

Indicators of Compromise

Unexpected kernel oops or panic traces referencing kprobes, optkprobes, or arch_arm_kprobe on x86 systems.
INT3 traps occurring at addresses that do not correspond to any registered probe.
Repeated registration and deregistration of kprobes at closely spaced addresses within the same function.

Detection Strategies

Audit kernel version strings across the fleet and compare against the fixed stable release containing the referenced commits.
Monitor /sys/kernel/debug/kprobes/list for probes placed within 5 bytes of one another on x86 hosts.
Correlate kernel crash reports with workloads that use eBPF, SystemTap, or BPF-based tracing tools that register kprobes.

Monitoring Recommendations

Collect dmesg and kmsg output centrally and alert on BUG:, general protection fault, or Oops entries referencing kprobe code paths.
Track usage of the perf_event_open syscall and kprobe_events tracefs interface by non-trusted workloads.
Enable kernel crash dump collection (kdump) to retain forensic evidence after a suspected overlap-induced fault.

How to Mitigate CVE-2026-98856

Immediate Actions Required

Identify Linux hosts running x86 kernels with CONFIG_OPTPROBES=y and schedule patching.
Apply the stable kernel update that includes the fix for get_optimized_kprobe() overlap handling.
Restrict CAP_SYS_ADMIN and access to tracefs and debugfs to trusted administrators only.

Patch Information

The fix is merged in the upstream Linux kernel and backported to multiple stable branches. Review the following commits for the exact change: 3f968dcd, 526fac21, 6745fa65, 7a39c732, and 985a5681. Rebuild and deploy distribution kernels that incorporate these patches.

Workarounds

Disable optimized kprobes by booting with CONFIG_OPTPROBES disabled or passing kernel parameters that prevent probe optimization where available.
Limit kprobe registration to vetted eBPF and tracing programs; block untrusted users from loading tracing programs via seccomp or Linux Security Modules.
Avoid tooling that registers multiple probes within tight address windows of the same function until patched kernels are deployed.

bash

# Verify kernel version and optkprobe configuration
uname -r
grep CONFIG_OPTPROBES /boot/config-$(uname -r)

# List currently registered kprobes (requires root)
cat /sys/kernel/debug/kprobes/list

# Restrict tracefs access to the root group
mount -o remount,gid=0,mode=0700 /sys/kernel/tracing