All vulnerabilities
CVE-2026-98048

Linux: bpf: don't rewrite bpf_fastcall patterns entered by a jump

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in24adbc2c3bbe3385ce922587e1f8e837a68b3e25Also 0b1c83dc3c4401cd7e846548f62e3caf3d06742eCVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 24adbc2c3bbe3385ce922587e1f8e837a68b3e25LinuxCVE List
  • 0b1c83dc3c4401cd7e846548f62e3caf3d06742eLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: don't rewrite bpf_fastcall patterns entered by a jump

mark_fastcall_pattern_for_call() must ensure that matched "spill; call; fill" instruction series is not interrupted by a jump. Otherwise the rewrite applied by bpf_remove_fastcall_spills_fills() is not sound.

Record the instructions targeted by jumps in insn_aux_data[*].jump_target when the CFG is built and use this flag to stop growing a pattern at such an instruction. Jumps to the first spill are fine.

Note that existing insn_aux_data[*].jmp_point field can't be reused, as it marks subprogram return instructions.

Text from CVE List

Affected versions 10

  • Linuxaffected: 5b5f51bff1b66cedb62b5ba74a1878341204e057 before a0cd1c3ac63504ba3c50c01a00c11812919b619fCVE List
  • Linuxaffected: 5b5f51bff1b66cedb62b5ba74a1878341204e057 before c4d3bdb3ab211dcfad734b02e06fcb12adb4757fCVE List
  • Linuxaffected: 5b5f51bff1b66cedb62b5ba74a1878341204e057 before 24adbc2c3bbe3385ce922587e1f8e837a68b3e25CVE List
  • Linuxaffected: 5b5f51bff1b66cedb62b5ba74a1878341204e057 before 0b1c83dc3c4401cd7e846548f62e3caf3d06742eCVE List
  • Linuxaffected: 6.12CVE List
  • Linuxunaffected: all versions before 6.12CVE List
  • Linuxunaffected: 6.12.114 through 6.12.*CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4