CVE-2026-98613: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-32jf-h832-m29p
Share
Published
Advisory Summary

CVE-2026-98613 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-98613 at a Glance

CVE Identifier CVE-2026-98613
GHSA Identifier GHSA-32jf-h832-m29p
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-98613

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-98613, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: bpf: Bound ownership depth through local kptrs and graph roots Program-allocated objects can own other local objects through referenced kptrs. bpf_obj_free_fields() follows those pointers through __bpf_obj_drop_impl() synchronously, before the object storage is freed through RCU. A self-referential local kptr type therefore permits arbitrarily deep object chains, and dropping the head can exhaust the kernel stack. Long acyclic type chains have the same problem. btf_check_and_fixup_fields() still assumes referenced kptrs only point to kernel types and checks ownership through list and rbtree roots only. Its existing rule is sufficient for graph-only cycles: the target of each graph edge must contain a node, so every type in a cycle has both a root and a node. The rule rejects such a type owning another root, breaking every cycle. It also limits graph-only chains to three types, or two if the first type contains a node, and conservatively rejects longer acyclic chains. The missing local-kptr edges, rather than a missed graph-only cycle, are the bug introduced by support for bpf_kptr_xchg() into local kptrs. Replace that restriction with one bounded ownership walk covering graph roots and local referenced kptrs. Run it after all BTF records have been fixed up, reject cycles and paths deeper than eight record-bearing types, and cache each type's suffix depth while checking it against the remaining budget. This also permits the longer acyclic graph-only layouts rejected by the old rule; update their existing BTF tests accordingly. Keep the bound independent of MAX_CALL_FRAMES because recursive destruction can run below a BPF call chain. A plain local pointee without special-field metadata adds only a final non-recursing drop. Non-owning kptrs and kernel-BTF kptrs do not recurse through local records and remain outside the walk. Include local percpu-kptr edges too, although allocation of percpu objects with special fields is currently forbidden, so that relaxing that restriction cannot bypass the ownership bound. btf_check_and_fixup_fields() continues to initialize graph_root.value_rec, including for separately allocated map records. The ownership relationships belong to immutable program BTF and only need validation at BTF load time.

References

NVD — CVE-2026-98613 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-98613
git.kernel.org/stable/c/4105870a4b... WEB
https://git.kernel.org/stable/c/4105870a4b8afe852aeb24a6dd58e1836cc4ce58
git.kernel.org/stable/c/92aa0502c7... WEB
https://git.kernel.org/stable/c/92aa0502c781d72bb9685245c3280efb3766a110
git.kernel.org/stable/c/9c11e543fe... WEB
https://git.kernel.org/stable/c/9c11e543fec32e92b3aa3f693339ca3ee79ea9dd
git.kernel.org/stable/c/bfc888f045... WEB
https://git.kernel.org/stable/c/bfc888f04588f591851e95c974954cfca58e6c19

Frequently Asked Questions

What is CVE-2026-98613?
CVE-2026-98613 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-98613?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-98613?
CVE-2026-98613 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-98613?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-32jf-h832-m29p",
  "modified" : "2026-10-18T18:31:56Z",
  "published" : "2026-10-18T18:31:56Z",
  "aliases" : [ "CVE-2026-98613" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Bound ownership depth through local kptrs and graph roots\n\nProgram-allocated objects can own other local objects through referenced\nkptrs. bpf_obj_free_fields() follows those pointers through\n__bpf_obj_drop_impl() synchronously, before the object storage is freed\nthrough RCU. A self-referential local kptr type therefore permits arbitrarily\ndeep object chains, and dropping the head can exhaust the kernel stack.\nLong acyclic type chains have the same problem.\n\nbtf_check_and_fixup_fields() still assumes referenced kptrs only point to\nkernel types and checks ownership through list and rbtree roots only. Its\nexisting rule is sufficient for graph-only cycles: the target of each graph\nedge must contain a node, so every type in a cycle has both a root and a\nnode. The rule rejects such a type owning another root, breaking every\ncycle. It also limits graph-only chains to three types, or two if the first\ntype contains a node, and conservatively rejects longer acyclic chains.\nThe missing local-kptr edges, rather than a missed graph-only cycle, are the\nbug introduced by support for bpf_kptr_xchg() into local kptrs.\n\nReplace that restriction with one bounded ownership walk covering graph\nroots and local referenced kptrs. Run it after all BTF records have been\nfixed up, reject cycles and paths deeper than eight record-bearing types,\nand cache each type's suffix depth while checking it against the remaining\nbudget. This also permits the longer acyclic graph-only layouts rejected\nby the old rule; update their existing BTF tests accordingly.\n\nKeep the bound independent of MAX_CALL_FRAMES because recursive destruction\ncan run below a BPF call chain. A plain local pointee without special-field\nmetadata adds only a final non-recursing drop. Non-owning kptrs and\nkernel-BTF kptrs do not recurse through local records and remain outside the\nwalk. Include local percpu-kptr edges too, although allocation of percpu\nobjects with special fields is currently forbidden, so that relaxing that\nrestriction cannot bypass the ownership bound.\n\nbtf_check_and_fixup_fields() continues to initialize graph_root.value_rec,\nincluding for separately allocated map records. The ownership relationships\nbelong to immutable program BTF and only need validation at BTF load time.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-98613"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4105870a4b8afe852aeb24a6dd58e1836cc4ce58"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/92aa0502c781d72bb9685245c3280efb3766a110"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/9c11e543fec32e92b3aa3f693339ca3ee79ea9dd"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/bfc888f04588f591851e95c974954cfca58e6c19"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-10-18T16:17:14Z"
  }
}