CVE-2026-98007: bpf: Reject non-scalar bpf_loop iteration counts
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject non-scalar bpfloop iteration counts
bpfloop() declares its nrloops argument as ARGANYTHING. Privileged programs may pass pointer values to such arguments, so checkfuncarg() lets a pointer-valued R1 reach the helper-specific checks.
Since commit bb124da69c47 ("bpf: keep track of max number of bpfloop callback iterations"), the verifier marks R1 precise and reads its upper bound to limit callback simulation. Precision backtracking only accepts scalar registers, so passing a pointer instead triggers the "backtracking misuse" verifier warning. Kernels with paniconwarn enabled subsequently panic.
Introduce ARGSCALAR for helper arguments that only accept scalar values and use it for bpfloop() nrloops. Generic helper argument validation then rejects pointers before loop inlining and precision processing.
Affected Software
Event History
Frequently Asked Questions
Who can trigger this issue?
A privileged BPF program must pass a pointer-valued register as the bpf_loop() iteration-count argument. The problematic path occurs during BPF verifier processing.
When does this become a system availability issue?
The malformed argument can trigger a verifier warning reporting "backtracking misuse." Systems configured with panic_on_warn enabled subsequently panic.
How can administrators identify possible exposure or exploitation attempts?
Look for Linux kernel verifier warnings containing "backtracking misuse," particularly while loading privileged BPF programs that use bpf_loop(). A panic following such a warning indicates that panic_on_warn was enabled.