All vulnerabilities
CVE-2026-98647

Linux: bpf: Fix divide-by-zero in btf_struct_walk()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1ea3820937f8022e044c41c6e95c84b02741b45fAlso 172756f02663ad45c889c001c1a8cb4082a01a05, 934e9ba9f8d05656a48624710be67ca4dc8482e6 and 2 moreCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 1ea3820937f8022e044c41c6e95c84b02741b45fLinuxCVE List
  • 172756f02663ad45c889c001c1a8cb4082a01a05LinuxCVE List
  • 934e9ba9f8d05656a48624710be67ca4dc8482e6LinuxCVE List
  • 63af086cb5fa6f72fd924f86bea4c2194da663a2LinuxCVE List
  • 8eb4cd72daad3a9ee63d2281bbdd16ce6d9406b1LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix divide-by-zero in btf_struct_walk()

When an access goes past the struct and the last member is a flexible array, btf_struct_walk() folds the offset back into a single element with (off - moff) % t->size, but never checks that the element type has a size.

BTF takes an empty struct, so this in program BTF

/* event could be empty */ struct event { #ifdef HAVE_TIMESTAMP __u64 ts; #endif };

struct batch { int nr; struct event events[]; };

divides by zero at prog load time. Getting there needs a PTR_TO_BTF_ID that is not MEM_ALLOC, e.g. a plain read of a local kptr stashed in a map from a sleepable program.

Oops: divide error: 0000 [#1] SMP KASAN PTI RIP: 0010:btf_struct_walk+0x53f/0x1570 Call Trace: <TASK> btf_struct_access+0x42a/0xcd0 check_ptr_to_btf_access+0x4dc/0x1160 check_mem_access+0x3a45/0x8740 check_load_mem+0x36a/0xd10 do_check_common+0x3ef0/0xb210 bpf_check+0x6d3b/0x8580 bpf_prog_load+0xf7c/0x2720 __sys_bpf+0xa83/0x3690 __x64_sys_bpf+0xc7/0x150 x64_sys_call+0x1f3f/0x27e0 do_syscall_64+0xe5/0x610 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK>

Reject a zero-sized element type. The fixed array path in the same function already bails out on the same thing:

btf_struct_walk() ... /* skip empty array */ if (moff == mtrue_end) continue;

msize /= total_nelems;

Text from CVE List

Affected versions 16

  • Linuxaffected: 9c5f8a1008a121e4c6b24af211034e24b0b63081 before 1ea3820937f8022e044c41c6e95c84b02741b45fCVE List
  • Linuxaffected: 9c5f8a1008a121e4c6b24af211034e24b0b63081 before 172756f02663ad45c889c001c1a8cb4082a01a05CVE List
  • Linuxaffected: 9c5f8a1008a121e4c6b24af211034e24b0b63081 before 934e9ba9f8d05656a48624710be67ca4dc8482e6CVE List
  • Linuxaffected: 9c5f8a1008a121e4c6b24af211034e24b0b63081 before 63af086cb5fa6f72fd924f86bea4c2194da663a2CVE List
  • Linuxaffected: 9c5f8a1008a121e4c6b24af211034e24b0b63081 before 8eb4cd72daad3a9ee63d2281bbdd16ce6d9406b1CVE List
  • Linuxaffected: 9c5f8a1008a121e4c6b24af211034e24b0b63081 before b8fa56722e9c43bcd59c51fe4c7edd5f4158a11bCVE List
  • Linuxaffected: 9c5f8a1008a121e4c6b24af211034e24b0b63081 before b0b3dc66529676228cb938cbcad66920f735c223CVE List
  • Linuxaffected: 5.8CVE List
  • Linuxunaffected: all versions before 5.8CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 7