In the Linux kernel, the following vulnerability has been resolved: bpf: Skip unsettled links in link iterator bpf_link_prime() inserts…
CVE-2026-98378 · GHSA-9m4g-3f3p-3783 · EUVD-2026-95533 · published 9 Oct 2026
How serious is it
- Severity: high, CVSS score 7.8 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-98378?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: 9f88361273082825d9f0d13a543d49f9fa0d44a8 <87ce4b53b7436b50fc984f0a6afaf77f68ac5573
- Linux Linux: 9f88361273082825d9f0d13a543d49f9fa0d44a8 <798a61edbc436cacdb659927d067368eeb1e30e2
- Linux Linux: patch: 6.1.189
- Linux Linux: patch: 6.18.55
- Linux Linux: patch: 6.6.158
- Linux Linux: 9f88361273082825d9f0d13a543d49f9fa0d44a8 <68930f8d40ab4c10ca3b019f076136758fd100a8
- Linux Linux: patch: 0
- Linux Linux: patch: 7.2.9
- Linux Linux: patch: 6.12.112
- Linux Linux: 9f88361273082825d9f0d13a543d49f9fa0d44a8 <6e271f093d15d323f42de26f66556af53fa8e19f
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
bpf: Skip unsettled links in link iterator
bpf_link_prime() inserts a link into link_idr before anon_inode_getfile()
succeeds and before bpf_link_settle() publishes the ID in link->id.
bpf_link_by_id() treats such an ID-zero link as unsettled, but the link
iterator takes a reference without this check.
If anon_inode_getfile() then fails, the creator removes the ID and frees
its still-private link directly. The iterator is left with a dangling
reference and its next bpf_link_put() accesses freed memory.
Treat ID-zero entries as transient in bpf_link_get_curr_or_next(), just as
bpf_link_by_id() does.
BUG: KASAN: slab-use-after-free in bpf_link_put
Write of size 8 by task exp/384
Call Trace:
bpf_link_put kernel/bpf/syscall.c:3372
bpf_link_seq_next kernel/bpf/link_iter.c:33
bpf_seq_read kernel/bpf/bpf_iter.c:158
vfs_read fs/read_write.c:572
ksys_read fs/read_write.c:716
do_syscall_64 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe arch/x86/entry/entry_64.S:121
Kernel panic - not syncing: KASAN: panic_on_warn set ...
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/68930f8d40ab4c10ca3b019f076136758fd100a8
- git.kernel.org/stable/c/c251ed48bd9063cf7de6049421e78b6de989060f
- git.kernel.org/stable/c/798a61edbc436cacdb659927d067368eeb1e30e2
- git.kernel.org/stable/c/6e271f093d15d323f42de26f66556af53fa8e19f
- git.kernel.org/stable/c/87ce4b53b7436b50fc984f0a6afaf77f68ac5573
- git.kernel.org/stable/c/50e80e2bb5e2be8515205b9c496b9640ddefa434
Merged from ENISA EUVD. Last updated 25 Oct 2026. All vulnerabilities · RSS · JSON