CVE-2026-98044: bpf: Reject legacy packet loads from callbacks
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject legacy packet loads from callbacks
checkldabs() models a failed BPFLDABS or BPFLDIND in a subprogram as an implicit return with R0 set to zero. It calls preparefuncexit() to explore this synthesized path.
When the load is reached directly from a synchronous callback, preparefuncexit() enforces the callback return contract and marks R0 precise. R0 is not derived from a real instruction on this path, so precision backtracking reaches the callback call with R0 still requested and triggers the "callback unexpected regs" verifier bug. A privileged program loader can therefore cause a verifier warning and an -EFAULT BPFPROGLOAD.
These legacy packet-load instructions are deprecated. Reject them from callbacks rather than complicating their implicit-return model. Check all active frames before constructing the implicit return so nested static subprograms cannot hide the callback context.
Global functions are verified independently with a fresh frame zero, so an active-frame check cannot identify a global function called from a callback. Also check the complete subprogram call graph during stack-depth validation and reject a function containing a legacy load when any caller is a callback. This covers global and static descendants without making hasldabs transitive, preserving its per-function BTF return-type check. Ordinary uses outside callbacks remain supported.
Affected Software
Event History
Frequently Asked Questions
Who can trigger this issue?
A privileged BPF program loader can trigger it. The affected path involves legacy BPF_LD_ABS or BPF_LD_IND packet-load instructions reached from a synchronous callback.
What is the practical impact of triggering it?
The BPF verifier can emit a "callback unexpected regs" warning and the program load fails with -EFAULT. The described impact is verifier failure during BPF_PROG_LOAD.
Is there a workaround if the kernel fix cannot be deployed immediately?
Avoid using the deprecated legacy BPF_LD_ABS and BPF_LD_IND packet-load instructions from callbacks. The issue can also involve nested static subprograms and complete subprogram call paths associated with callbacks.