All vulnerabilities
CVE-2026-98085

Linux: bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in19cca7c36055906b3cff3e297618ee8a50cde25dAlso 12c064bcfa56e3631be9f5336ee113b7f849959a, 671b7b9a660ef15b25faa3df161205b9dc8d1eb2 and 8 moreCVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 19cca7c36055906b3cff3e297618ee8a50cde25dLinuxCVE List
  • 12c064bcfa56e3631be9f5336ee113b7f849959aLinuxCVE List
  • 671b7b9a660ef15b25faa3df161205b9dc8d1eb2LinuxCVE List
  • 387b1baefbb776e3f48dc2261e77a49213f470f7LinuxCVE List
  • 6.6.160LinuxCVE List
  • 6.12.114LinuxCVE List
Show all 11 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge

Nicholas Carlini reported a bug in precision backtracking mechanism for BPF_LD | BPF_{IND,ABS} instructions. These instructions are modelled as two branches:

  • fallthrough;
  • implicit exit from current subprogram.

The implicit exit case was not handled by the backtrack_insn() function. When backtracking such a path backtrack_insn() did not call bt_subprog_enter(), which meant that backtracking continued manipulating precision marks in a caller frame, while looking at instructions in a callee frame.

This lead to segmentation faults during verification (see the selftest), or unsound state pruning.

Text from CVE List

Affected versions 23

  • Linuxaffected: 37ad2bb11e9de92cb7b94548705eeedd87f7d392 before 19cca7c36055906b3cff3e297618ee8a50cde25dCVE List
  • Linuxaffected: 8674e2db06cff6b50f2216eed9a761d15425bb34 before 12c064bcfa56e3631be9f5336ee113b7f849959aCVE List
  • Linuxaffected: ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337 before a0cd9e22f8faed30a8da8be357c51bd8b3074ee9CVE List
  • Linuxaffected: ee861486e377edc55361c08dcbceab3f6b6577bd before 671b7b9a660ef15b25faa3df161205b9dc8d1eb2CVE List
  • Linuxaffected: ee861486e377edc55361c08dcbceab3f6b6577bd before 387b1baefbb776e3f48dc2261e77a49213f470f7CVE List
  • Linuxaffected: 928d354ae3557e8f755a227e67be88034eb3cd7fCVE List
  • Linuxaffected: 8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbeCVE List
  • Linuxaffected: de1055e7f9e67af32b1f3376066272b04e5223c0CVE List
  • Linuxaffected: d846d83bdacbd8f14fc45c63b8c1d22608452e1cCVE List
  • Linuxaffected: 6.6.148 before 6.6.160CVE List
  • Linuxaffected: 6.12.101 before 6.12.114CVE List
  • Linuxaffected: 6.18.42 before 6.18.57CVE List
  • Linuxaffected: 5.10.265 before 5.11CVE List
  • Linuxaffected: 5.15.216 before 5.16CVE List
  • Linuxaffected: 6.1.183 before 6.2CVE List
  • Linuxaffected: 7.0.10 before 7.1CVE List
  • Linuxaffected: 7.1CVE List
  • Linuxunaffected: all versions before 7.1CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.114 through 6.12.*CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5