CVE-2026-98044 (GCVE-0-2026-98044)

Vulnerability from cvelistv5 – Published: 2026-09-25 10:23 – Updated: 2026-09-25 10:23
VLAI
Title
bpf: Reject legacy packet loads from callbacks
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject legacy packet loads from callbacks check_ld_abs() models a failed BPF_LD_ABS or BPF_LD_IND in a subprogram as an implicit return with R0 set to zero. It calls prepare_func_exit() to explore this synthesized path. When the load is reached directly from a synchronous callback, prepare_func_exit() enforces the callback return contract and marks R0 precise. R0 is not derived from a real instruction on this path, so precision backtracking reaches the callback call with R0 still requested and triggers the "callback unexpected regs" verifier bug. A privileged program loader can therefore cause a verifier warning and an -EFAULT BPF_PROG_LOAD. These legacy packet-load instructions are deprecated. Reject them from callbacks rather than complicating their implicit-return model. Check all active frames before constructing the implicit return so nested static subprograms cannot hide the callback context. Global functions are verified independently with a fresh frame zero, so an active-frame check cannot identify a global function called from a callback. Also check the complete subprogram call graph during stack-depth validation and reject a function containing a legacy load when any caller is a callback. This covers global and static descendants without making has_ld_abs transitive, preserving its per-function BTF return-type check. Ordinary uses outside callbacks remain supported.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337 , < 3484a99303912db62428494a9061212049027e57 (git)
Affected: ee861486e377edc55361c08dcbceab3f6b6577bd , < bc489c0c9b8c86bd7fac42cfd1bb152f042fca56 (git)
Affected: ee861486e377edc55361c08dcbceab3f6b6577bd , < e7d28823c662128caae63f14e16bd394916c139b (git)
Affected: 928d354ae3557e8f755a227e67be88034eb3cd7f (git)
Affected: 8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbe (git)
Affected: de1055e7f9e67af32b1f3376066272b04e5223c0 (git)
Affected: 37ad2bb11e9de92cb7b94548705eeedd87f7d392 (git)
Affected: 8674e2db06cff6b50f2216eed9a761d15425bb34 (git)
Affected: d846d83bdacbd8f14fc45c63b8c1d22608452e1c (git)
Affected: 6.18.42 , < 6.18.53 (semver)
Affected: 5.10.265 , < 5.11 (semver)
Affected: 5.15.216 , < 5.16 (semver)
Affected: 6.1.183 , < 6.2 (semver)
Affected: 6.6.148 , < 6.7 (semver)
Affected: 6.12.101 , < 6.13 (semver)
Affected: 7.0.10 , < 7.1 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2.7 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3484a99303912db62428494a9061212049027e57",
              "status": "affected",
              "version": "ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337",
              "versionType": "git"
            },
            {
              "lessThan": "bc489c0c9b8c86bd7fac42cfd1bb152f042fca56",
              "status": "affected",
              "version": "ee861486e377edc55361c08dcbceab3f6b6577bd",
              "versionType": "git"
            },
            {
              "lessThan": "e7d28823c662128caae63f14e16bd394916c139b",
              "status": "affected",
              "version": "ee861486e377edc55361c08dcbceab3f6b6577bd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "928d354ae3557e8f755a227e67be88034eb3cd7f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbe",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "de1055e7f9e67af32b1f3376066272b04e5223c0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "37ad2bb11e9de92cb7b94548705eeedd87f7d392",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8674e2db06cff6b50f2216eed9a761d15425bb34",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d846d83bdacbd8f14fc45c63b8c1d22608452e1c",
              "versionType": "git"
            },
            {
              "lessThan": "6.18.53",
              "status": "affected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThan": "6.13",
              "status": "affected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThan": "7.1",
              "status": "affected",
              "version": "7.0.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "6.18.42",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.265",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.216",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.183",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.148",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.12.101",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "7.0.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject legacy packet loads from callbacks\n\ncheck_ld_abs() models a failed BPF_LD_ABS or BPF_LD_IND in a\nsubprogram as an implicit return with R0 set to zero. It calls\nprepare_func_exit() to explore this synthesized path.\n\nWhen the load is reached directly from a synchronous callback,\nprepare_func_exit() enforces the callback return contract and marks R0\nprecise. R0 is not derived from a real instruction on this path, so\nprecision backtracking reaches the callback call with R0 still requested\nand triggers the \"callback unexpected regs\" verifier bug. A privileged\nprogram loader can therefore cause a verifier warning and an -EFAULT\nBPF_PROG_LOAD.\n\nThese legacy packet-load instructions are deprecated. Reject them from\ncallbacks rather than complicating their implicit-return model. Check all\nactive frames before constructing the implicit return so nested static\nsubprograms cannot hide the callback context.\n\nGlobal functions are verified independently with a fresh frame zero, so\nan active-frame check cannot identify a global function called from a\ncallback. Also check the complete subprogram call graph during stack-depth\nvalidation and reject a function containing a legacy load when any caller\nis a callback. This covers global and static descendants without making\nhas_ld_abs transitive, preserving its per-function BTF return-type check.\nOrdinary uses outside callbacks remain supported."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T10:23:55.454Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3484a99303912db62428494a9061212049027e57"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc489c0c9b8c86bd7fac42cfd1bb152f042fca56"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7d28823c662128caae63f14e16bd394916c139b"
        }
      ],
      "title": "bpf: Reject legacy packet loads from callbacks",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98044",
    "datePublished": "2026-09-25T10:23:55.454Z",
    "dateReserved": "2026-09-25T10:19:56.071Z",
    "dateUpdated": "2026-09-25T10:23:55.454Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-98044",
      "date": "2026-09-27",
      "epss": "0.00166",
      "percentile": "0.05191"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/bpf/verifier.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3484a99303912db62428494a9061212049027e57",
                    "status": "affected",
                    "version": "ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bc489c0c9b8c86bd7fac42cfd1bb152f042fca56",
                    "status": "affected",
                    "version": "ee861486e377edc55361c08dcbceab3f6b6577bd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e7d28823c662128caae63f14e16bd394916c139b",
                    "status": "affected",
                    "version": "ee861486e377edc55361c08dcbceab3f6b6577bd",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "928d354ae3557e8f755a227e67be88034eb3cd7f",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbe",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "de1055e7f9e67af32b1f3376066272b04e5223c0",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "37ad2bb11e9de92cb7b94548705eeedd87f7d392",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "8674e2db06cff6b50f2216eed9a761d15425bb34",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "d846d83bdacbd8f14fc45c63b8c1d22608452e1c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.18.53",
                    "status": "affected",
                    "version": "6.18.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.11",
                    "status": "affected",
                    "version": "5.10.265",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.16",
                    "status": "affected",
                    "version": "5.15.216",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.2",
                    "status": "affected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.7",
                    "status": "affected",
                    "version": "6.6.148",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.13",
                    "status": "affected",
                    "version": "6.12.101",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "7.1",
                    "status": "affected",
                    "version": "7.0.10",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "kernel/bpf/verifier.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.1"
                  },
                  {
                    "lessThan": "7.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject legacy packet loads from callbacks\n\ncheck_ld_abs() models a failed BPF_LD_ABS or BPF_LD_IND in a\nsubprogram as an implicit return with R0 set to zero. It calls\nprepare_func_exit() to explore this synthesized path.\n\nWhen the load is reached directly from a synchronous callback,\nprepare_func_exit() enforces the callback return contract and marks R0\nprecise. R0 is not derived from a real instruction on this path, so\nprecision backtracking reaches the callback call with R0 still requested\nand triggers the \"callback unexpected regs\" verifier bug. A privileged\nprogram loader can therefore cause a verifier warning and an -EFAULT\nBPF_PROG_LOAD.\n\nThese legacy packet-load instructions are deprecated. Reject them from\ncallbacks rather than complicating their implicit-return model. Check all\nactive frames before constructing the implicit return so nested static\nsubprograms cannot hide the callback context.\n\nGlobal functions are verified independently with a fresh frame zero, so\nan active-frame check cannot identify a global function called from a\ncallback. Also check the complete subprogram call graph during stack-depth\nvalidation and reject a function containing a legacy load when any caller\nis a callback. This covers global and static descendants without making\nhas_ld_abs transitive, preserving its per-function BTF return-type check.\nOrdinary uses outside callbacks remain supported."
          }
        ],
        "id": "CVE-2026-98044",
        "lastModified": "2026-09-25T11:17:33.200",
        "metrics": {},
        "published": "2026-09-25T11:17:33.200",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3484a99303912db62428494a9061212049027e57"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bc489c0c9b8c86bd7fac42cfd1bb152f042fca56"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e7d28823c662128caae63f14e16bd394916c139b"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.