CVE-2026-98530: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-2p4m-w3h2-4q6g
Share
Published
Advisory Summary

CVE-2026-98530 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-98530 at a Glance

CVE Identifier CVE-2026-98530
GHSA Identifier GHSA-2p4m-w3h2-4q6g
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-98530

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-98530, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix permanent hang when flushing the kprobe optimizer Writing 0 to /proc/sys/debug/kprobes-optimization while a kprobe is jump-optimized never returns. The writer sleeps in D state forever with kprobe_sysctl_mutex held, so any later read or write of that sysctl hangs as well. For example, with vfs_read+9 as an optimizable address in this build: # cd /sys/kernel/tracing # echo 'p:myprobe vfs_read+9' >> kprobe_events # echo 1 > events/kprobes/myprobe/enable # # wait until /sys/kernel/debug/kprobes/list shows [OPTIMIZED] # echo 0 > /proc/sys/debug/kprobes-optimization INFO: task sh:246 blocked for more than 10 seconds. Call Trace: <TASK> __schedule+0x1176/0x4f70 schedule+0xdc/0x2c0 schedule_timeout+0x17b/0x260 wait_for_completion+0x173/0x3c0 wait_for_kprobe_optimizer_locked+0xbc/0x130 proc_kprobes_optimization_handler+0x156/0x1b0 proc_sys_call_handler+0x324/0x490 vfs_write+0x52d/0xfe0 ksys_write+0xff/0x200 do_syscall_64+0x106/0x630 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> ... INFO: task cat:265 is blocked on a mutex likely owned by task sh:246. wait_for_kprobe_optimizer_locked() reinitializes optimizer_completion, asks the optimizer thread to flush and sleeps in wait_for_completion(). The thread drains the (un)optimizing lists, but calls complete() only if completion_done() is true, i.e. if the completion is already done, which never happens while someone waits. disarm_all_kprobes() and kprobe_trace_self_tests_init() wait the same way. Calling complete() unconditionally would not be enough: the waiter drops kprobe_mutex while it sleeps, and nothing else serializes the sysctl handler against the debugfs "enabled" file. A second flusher that still finds the lists non-empty, e.g. because a disabled probe is queued for unoptimizing, reinitializes the completion under the first: sysctl write debugfs "enabled" write unoptimize_all_kprobes() wait_for_kprobe_optimizer_locked() init_completion(c) mutex_unlock(&kprobe_mutex) wait_for_completion(c) disarm_all_kprobes() wait_for_kprobe_optimizer_locked() init_completion(c) // c->wait is reset, the first // waiter is off the queue mutex_unlock(&kprobe_mutex) wait_for_completion(c) kprobe_optimizer() complete(c) // wakes the debugfs writer only where c is &optimizer_completion. Lining up the two writes during an optimizer pass loses the sysctl writer this way. Replace the completion with a counter of optimizer passes, bumped at the end of each pass and signalled with wake_up_var_locked(), both under kprobe_mutex. A flusher samples the count and waits with wait_var_event_mutex(), which drops kprobe_mutex only while sleeping, so a new count means a whole pass ran in the meantime. Nothing is reinitialized, so several flushers can sleep in the wait at once.

References

NVD — CVE-2026-98530 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-98530
git.kernel.org/stable/c/5bfa9f1a9d... WEB
https://git.kernel.org/stable/c/5bfa9f1a9dcb6ecb607adbc1c0226605c972935b
git.kernel.org/stable/c/f05a01fc7d... WEB
https://git.kernel.org/stable/c/f05a01fc7d4f731b4c100d2aef1e85ad77728862

Frequently Asked Questions

What is CVE-2026-98530?
CVE-2026-98530 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-98530?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-98530?
CVE-2026-98530 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-98530?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-2p4m-w3h2-4q6g",
  "modified" : "2026-10-18T18:31:52Z",
  "published" : "2026-10-18T18:31:52Z",
  "aliases" : [ "CVE-2026-98530" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nkprobes: Fix permanent hang when flushing the kprobe optimizer\n\nWriting 0 to /proc/sys/debug/kprobes-optimization while a kprobe is\njump-optimized never returns. The writer sleeps in D state forever with\nkprobe_sysctl_mutex held, so any later read or write of that sysctl\nhangs as well. For example, with vfs_read+9 as an optimizable address\nin this build:\n\n  # cd /sys/kernel/tracing\n  # echo 'p:myprobe vfs_read+9' >> kprobe_events\n  # echo 1 > events/kprobes/myprobe/enable\n  # # wait until /sys/kernel/debug/kprobes/list shows [OPTIMIZED]\n  # echo 0 > /proc/sys/debug/kprobes-optimization\n\n  INFO: task sh:246 blocked for more than 10 seconds.\n  Call Trace:\n   <TASK>\n   __schedule+0x1176/0x4f70\n   schedule+0xdc/0x2c0\n   schedule_timeout+0x17b/0x260\n   wait_for_completion+0x173/0x3c0\n   wait_for_kprobe_optimizer_locked+0xbc/0x130\n   proc_kprobes_optimization_handler+0x156/0x1b0\n   proc_sys_call_handler+0x324/0x490\n   vfs_write+0x52d/0xfe0\n   ksys_write+0xff/0x200\n   do_syscall_64+0x106/0x630\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n   </TASK>\n  ...\n  INFO: task cat:265 is blocked on a mutex likely owned by task sh:246.\n\nwait_for_kprobe_optimizer_locked() reinitializes optimizer_completion,\nasks the optimizer thread to flush and sleeps in wait_for_completion().\nThe thread drains the (un)optimizing lists, but calls complete() only\nif completion_done() is true, i.e. if the completion is already done,\nwhich never happens while someone waits. disarm_all_kprobes() and\nkprobe_trace_self_tests_init() wait the same way.\n\nCalling complete() unconditionally would not be enough: the waiter\ndrops kprobe_mutex while it sleeps, and nothing else serializes the\nsysctl handler against the debugfs \"enabled\" file. A second flusher\nthat still finds the lists non-empty, e.g. because a disabled probe is\nqueued for unoptimizing, reinitializes the completion under the first:\n\n  sysctl write                      debugfs \"enabled\" write\n  unoptimize_all_kprobes()\n    wait_for_kprobe_optimizer_locked()\n      init_completion(c)\n      mutex_unlock(&kprobe_mutex)\n      wait_for_completion(c)\n                                    disarm_all_kprobes()\n                                      wait_for_kprobe_optimizer_locked()\n                                        init_completion(c)\n                                          // c->wait is reset, the first\n                                          // waiter is off the queue\n                                        mutex_unlock(&kprobe_mutex)\n                                        wait_for_completion(c)\n  kprobe_optimizer()\n    complete(c)\n      // wakes the debugfs writer only\n\nwhere c is &optimizer_completion. Lining up the two writes during an\noptimizer pass loses the sysctl writer this way.\n\nReplace the completion with a counter of optimizer passes, bumped at the\nend of each pass and signalled with wake_up_var_locked(), both under\nkprobe_mutex. A flusher samples the count and waits with\nwait_var_event_mutex(), which drops kprobe_mutex only while sleeping, so\na new count means a whole pass ran in the meantime. Nothing is\nreinitialized, so several flushers can sleep in the wait at once.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-98530"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/5bfa9f1a9dcb6ecb607adbc1c0226605c972935b"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/f05a01fc7d4f731b4c100d2aef1e85ad77728862"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-10-18T16:17:04Z"
  }
}