All vulnerabilities
CVE-2026-98007

Linux: bpf: Reject non-scalar bpf_loop iteration counts

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2ff38b3552af53238aee6c877ae64cc798d46fceAlso 656d40d1ca228ee21a9b3280432479fc9eae75ab, 6.6.158CVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 2ff38b3552af53238aee6c877ae64cc798d46fceLinuxCVE List
  • 656d40d1ca228ee21a9b3280432479fc9eae75abLinuxCVE List
  • 6.6.158LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject non-scalar bpf_loop iteration counts

bpf_loop() declares its nr_loops argument as ARG_ANYTHING. Privileged programs may pass pointer values to such arguments, so check_func_arg() lets a pointer-valued R1 reach the helper-specific checks.

Since commit bb124da69c47 ("bpf: keep track of max number of bpf_loop callback iterations"), the verifier marks R1 precise and reads its upper bound to limit callback simulation. Precision backtracking only accepts scalar registers, so passing a pointer instead triggers the "backtracking misuse" verifier warning. Kernels with panic_on_warn enabled subsequently panic.

Introduce ARG_SCALAR for helper arguments that only accept scalar values and use it for bpf_loop() nr_loops. Generic helper argument validation then rejects pointers before loop inlining and precision processing.

Text from CVE List

Affected versions 13

  • Linuxaffected: bfc5c19b4b48840627af0d0f1c8f4461b276e508 before 2ff38b3552af53238aee6c877ae64cc798d46fceCVE List
  • Linuxaffected: bb124da69c47dd98d69361ec13244ece50bec63e before 656d40d1ca228ee21a9b3280432479fc9eae75abCVE List
  • Linuxaffected: bb124da69c47dd98d69361ec13244ece50bec63e before e2e1161e03fecff6d2229a81b024337144bfcd97CVE List
  • Linuxaffected: bb124da69c47dd98d69361ec13244ece50bec63e before f8ae8275c721334ee50fafdd986fb83294eb941aCVE List
  • Linuxaffected: bb124da69c47dd98d69361ec13244ece50bec63e before c3fd8e5fd100f122bad503bdc0e9277219533253CVE List
  • Linuxaffected: 6.6.15 before 6.6.158CVE List
  • Linuxaffected: 6.7CVE List
  • Linuxunaffected: all versions before 6.7CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5