CVE-2026-98800

A race in BPF trampoline program teardown can free a program while a task preempted inside the trampoline is still able to call it. The task may be interrupted before the program enter helper acquires its RCU read lock, so the previous RCU synchronization does not protect this execution path. When the task resumes it can execute or access the freed BPF program, producing a confirmed use-after-free symptom reported by KASAN as a vmalloc-out-of-bounds read. Impact is at least a local denial of service via kernel crash. Because the freed object is a trampoline linked BPF program and may be reused before the preempted task resumes, the worst case may include confidentiality and integrity impact or privilege escalation and should be reviewed manually. For the CVSS the PR:L in the paranoid score represents environments where BPF tracing capabilities are delegated to a restricted service account, container root, or local BPF operator without full host administration. AC:H applies because successful triggering depends on a preemption race window. The issue is local and is not directly network reachable.