All vulnerabilities
CVE-2026-98044

Linux: bpf: Reject legacy packet loads from callbacks

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3484a99303912db62428494a9061212049027e57Also 6.12.114, 6.18.53 and 5 moreCVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

Show all 8 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject legacy packet loads from callbacks

check_ld_abs() models a failed BPF_LD_ABS or BPF_LD_IND in a subprogram as an implicit return with R0 set to zero. It calls prepare_func_exit() to explore this synthesized path.

When the load is reached directly from a synchronous callback, prepare_func_exit() enforces the callback return contract and marks R0 precise. R0 is not derived from a real instruction on this path, so precision backtracking reaches the callback call with R0 still requested and triggers the "callback unexpected regs" verifier bug. A privileged program loader can therefore cause a verifier warning and an -EFAULT BPF_PROG_LOAD.

These legacy packet-load instructions are deprecated. Reject them from callbacks rather than complicating their implicit-return model. Check all active frames before constructing the implicit return so nested static subprograms cannot hide the callback context.

Global functions are verified independently with a fresh frame zero, so an active-frame check cannot identify a global function called from a callback. Also check the complete subprogram call graph during stack-depth validation and reject a function containing a legacy load when any caller is a callback. This covers global and static descendants without making has_ld_abs transitive, preserving its per-function BTF return-type check. Ordinary uses outside callbacks remain supported.

Text from CVE List

Affected versions 22

  • Linuxaffected: 8674e2db06cff6b50f2216eed9a761d15425bb34 before cebda2a2bb4183550eae9dcf888c16407b4fffdaCVE List
  • Linuxaffected: ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337 before 3484a99303912db62428494a9061212049027e57CVE List
  • Linuxaffected: ee861486e377edc55361c08dcbceab3f6b6577bd before bc489c0c9b8c86bd7fac42cfd1bb152f042fca56CVE List
  • Linuxaffected: ee861486e377edc55361c08dcbceab3f6b6577bd before e7d28823c662128caae63f14e16bd394916c139bCVE List
  • Linuxaffected: 928d354ae3557e8f755a227e67be88034eb3cd7fCVE List
  • Linuxaffected: 8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbeCVE List
  • Linuxaffected: de1055e7f9e67af32b1f3376066272b04e5223c0CVE List
  • Linuxaffected: 37ad2bb11e9de92cb7b94548705eeedd87f7d392CVE List
  • Linuxaffected: d846d83bdacbd8f14fc45c63b8c1d22608452e1cCVE List
  • Linuxaffected: 6.12.101 before 6.12.114CVE List
  • Linuxaffected: 6.18.42 before 6.18.53CVE List
  • Linuxaffected: 5.10.265 before 5.11CVE List
  • Linuxaffected: 5.15.216 before 5.16CVE List
  • Linuxaffected: 6.1.183 before 6.2CVE List
  • Linuxaffected: 6.6.148 before 6.7CVE List
  • Linuxaffected: 7.0.10 before 7.1CVE List
  • Linuxaffected: 7.1CVE List
  • Linuxunaffected: all versions before 7.1CVE List
  • Linuxunaffected: 6.12.114 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4