CVE-2026-98599: bpf: Reject non-negative offsets in stack_slot_obj_get_spi()
bpf: Reject non-negative offsets in stackslotobjgetspi()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In stack_slot_obj_get_spi(), reject non-negative offsets before converting the offset to a stack index (spi).
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs to load a BPF program that can present a PTR_TO_STACK register with a non-negative frame-pointer offset, specifically fp+0, to stack_slot_obj_get_spi(). Exploitation also involves an effectful iterator kfunc interpreting memory outside the BPF stack as iterator state.
Which stack-object references are valid after the fix?
Valid stack objects must begin at a negative offset from the BPF frame pointer. Non-negative offsets are rejected before they are converted into a stack-pointer index.
What condition indicates that a BPF program may be affected?
A potentially affected program uses an iterator stored at fp-8 while passing or validating a PTR_TO_STACK value at fp+0. Before the fix, offset zero could map to the same stack-pointer index as the valid fp-8 stack slot.