CVE-2026-98084: bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks
In the Linux kernel, the following vulnerability has been resolved:
bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks
When processing calls to bpfloop() verifier marks R1 (and R4) as precise. R1 tracks loop iterations number and because of the 'callbackdepth < R1' mechanics in checkhelpercall() must be marked precise. However, precision propagation for R1 was broken, when bpfloop() call was verified on a second iteration.
Consider the following verification trace: - main: bpfloop(nrloops, callback ...) - callback: BPFEXIT - main: bpfloop(nrloops, callback ...) - ...
While the first visit of the call to bpfloop() propagated R1 precision as expected, the second call to markchainprecision() in the checkhelpercall() set R1, but it was immediately reset when backtrackinsn() processed preceding BPFEXIT in the loop deleted in this patch.
Because of that, the second visit of the call to bpfloop() injected checkpoint with R1 not marked as precise. Which could trick the verifier into accepting unsafe programs. See the next patch for an example of such program.
Commit is structured in a way to minimize conflicts when 'bpf' would be eventually merged with 'bpf-next'.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker would need to load a crafted eBPF program that uses bpf_loop() and reaches repeated verifier processing of the helper call. The flaw can cause the verifier to accept an unsafe program by failing to preserve precision tracking for R1 on a later visit.
Who is realistically exposed?
Systems that allow an attacker or untrusted workload to submit eBPF programs for kernel verification are the relevant exposure boundary. The provided information does not identify affected kernel versions or specific configurations.
How can I tell whether my kernel includes the fix?
Check whether the kernel contains either referenced stable commit: f83890dfed9efc5e19df1dbc1ad707a142936923 or e3e4f66cc4b72333d0886ae2673c360248987889. The supplied data does not provide release-version mappings for those commits.