CVE-2026-98048: bpf: don't rewrite bpf_fastcall patterns entered by a jump
In the Linux kernel, the following vulnerability has been resolved:
bpf: don't rewrite bpffastcall patterns entered by a jump
markfastcallpatternforcall() must ensure that matched "spill; call; fill" instruction series is not interrupted by a jump. Otherwise the rewrite applied by bpfremovefastcallspillsfills() is not sound.
Record the instructions targeted by jumps in insnauxdata[].jumptarget when the CFG is built and use this flag to stop growing a pattern at such an instruction. Jumps to the first spill are fine.
Note that existing insnauxdata[].jmppoint field can't be reused, as it marks subprogram return instructions.
Affected Software
Event History
Frequently Asked Questions
What code path is affected?
The issue is in the Linux kernel's BPF handling of bpf_fastcall instruction patterns. It concerns a matched "spill; call; fill" sequence that is entered or interrupted by a jump.
What condition triggers the unsafe rewrite?
The problem occurs when the fastcall-pattern matcher grows a pattern across an instruction targeted by a jump. Rewriting such a sequence can be unsound; jumps to the first spill instruction are explicitly considered acceptable.
What does the fix change?
The fix records jump-target instructions in insn_aux_data[*].jump_target while building the control-flow graph. The fastcall-pattern matcher then stops extending a pattern when it reaches a jump target.