CVE-2026-98061: bpf: Reject tail calls directly from callback frames
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject tail calls directly from callback frames
A tail call from a non-zero frame is modeled as a return from that frame. The verifier makes R0 unknown and calls preparefuncexit() for the taken branch.
When the current frame is a synchronous callback, preparefuncexit() enforces the callback return-value contract and marks R0 precise. Since the tail-call path synthesized R0 rather than deriving it from an instruction, precision backtracking reaches the callback-calling instruction with R0 still requested and triggers the "callback unexpected regs" verifier bug. A CAPBPF task can therefore cause a WARN and an -EFAULT BPFPROGLOAD.
Tail calls reachable from callbacks are already rejected later by checkmaxstackdepth(). Reject a tail call made directly by a callback before constructing the inconsistent return state, using the existing diagnostic. Tail calls from ordinary subprograms keep their current behavior.
Affected Software
Event History
Frequently Asked Questions
What privileges does an attacker need to trigger this issue?
The triggering task must have CAP_BPF. The issue is reached while loading a crafted BPF program.
What is the observable impact of a trigger attempt?
A successful trigger can cause a kernel WARN, and the BPF program load fails with -EFAULT. The provided information does not describe privilege escalation, code execution, or a successful program load.
Which BPF program structures are implicated?
The problematic path involves a tail call made directly from a synchronous callback frame. Tail calls from ordinary subprograms retain their existing behavior.
How can an operator recognize a possible attempted trigger?
Look for a kernel WARN associated with BPF program loading together with a BPF_PROG_LOAD failure returning -EFAULT. These symptoms would be relevant when the loading task has CAP_BPF.