CVE-2026-98085: bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge
In the Linux kernel, the following vulnerability has been resolved:
bpf: backtrackinsn(): Handle ld{abs,ind} subprog exit edge
Nicholas Carlini reported a bug in precision backtracking mechanism for BPFLD | BPF{IND,ABS} instructions. These instructions are modelled as two branches: - fallthrough; - implicit exit from current subprogram.
The implicit exit case was not handled by the backtrackinsn() function. When backtracking such a path backtrackinsn() did not call btsubprogenter(), which meant that backtracking continued manipulating precision marks in a caller frame, while looking at instructions in a callee frame.
This lead to segmentation faults during verification (see the selftest), or unsound state pruning.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the issue?
The vulnerable path involves BPF_LD instructions using the BPF_IND or BPF_ABS modes and an implicit exit from the current BPF subprogram during verifier precision backtracking. Triggering it requires BPF program verification to process such a path.
What impact can occur during BPF verification?
The verifier can manipulate precision marks in the caller frame while examining instructions in a callee frame. This can cause segmentation faults during verification or unsound state pruning.
How can I tell whether a system is affected?
The provided information identifies the affected software only as the Linux kernel and does not specify affected or fixed kernel versions. Check whether the kernel includes either referenced stable commit, 671b7b9a660ef15b25faa3df161205b9dc8d1eb2 or 387b1baefbb776e3f48dc2261e77a49213f470f7.