CVE-2026-98540: fprobe: Terminate the fgraph_data list when the reservation is not filled
In the Linux kernel, the following vulnerability has been resolved:
fprobe: Terminate the fgraphdata list when the reservation is not filled
fprobefgraphentry() reserves shadow stack space for every fprobe with an exit handler, but only fills it for those whose entry handler returns 0. fgraphreservedata() does not clear the area, so fprobereturn() parses the unused tail as headers left over from an earlier call, and an exit handler can run twice or despite its entry handler asking to skip it.
Write a zero word after the last entry to terminate the walk. A zeroed slot does not decode to a NULL fprobe on the arches that encode the header into one unsigned long, since archdecodefprobeheaderfp() ORs in FPROBEHEADERMSBPATTERN, so make readfprobeheader() return NULL for a zeroed slot.