CVE-2026-98075: bpf: reject BPF_PSEUDO_FUNC reference to the main program
In the Linux kernel, the following vulnerability has been resolved:
bpf: reject BPFPSEUDOFUNC reference to the main program
fixups.c:jitsubprogs() rewrites BPFPSEUDOFUNC loads to contain real function addresses. This function is invoked from bpfjitsubprogs() only when env->subprogcnt > 1. Meaning that for any program like below:
int main(void ctx) { void ptr = main; ... bpftimersetcallback(..., ptr); ... }
The 'ptr' won't be ever converted to contain an address. In combination with e.g. bpftimersetcallback() this would lead to a function call at a bogus address.
Instead of complicating the implementation, just assume that no useful program needs main to be a sync or async callback and reject BPFPSEUDOFUNC loads for the main subprogram.
Affected Software
Event History
Frequently Asked Questions
What program pattern is required to trigger the issue?
A BPF program must create a BPF_PSEUDO_FUNC reference to its main program and use that reference as a synchronous or asynchronous callback. The described example passes the main-program reference to bpf_timer_set_callback().
Why does this result in a bad callback target?
The JIT subprogram fixup rewrites BPF_PSEUDO_FUNC loads to real function addresses only when env->subprog_cnt is greater than 1. A reference to the main program can therefore remain unreplaced and be used as a bogus function address.
How can I look for potentially affected BPF programs?
Inspect loaded or source BPF programs for BPF_PSEUDO_FUNC loads that target the entry/main subprogram, particularly where the resulting pointer is supplied to timer callbacks or other synchronous or asynchronous callback mechanisms.
What changes after applying the fix?
The kernel rejects BPF_PSEUDO_FUNC loads that reference the main subprogram. Programs attempting to use the main program as a callback through such a reference will no longer be accepted.