CVE-2026-98628: bpf: Make post-verification instruction rewrites killable
bpf: Make post-verification instruction rewrites killable
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Make bpf_patch_insn_data() and verifier_remove_insns() cancellation and rescheduling points, and report interrupted constant blinding as -EINTR while propagating it through both JIT paths, including kernels that permit interpreter fallback.
Event History
Frequently Asked Questions
Who can trigger the resource-exhaustion condition?
A privileged BPF program loader can trigger it by submitting a program containing 131072 unconditional jump-by-zero instructions followed by a valid return. The issue occurs during post-verification instruction rewrite work in the BPF_PROG_LOAD process context.
What is the operational impact during exploitation?
The post-verification rewrite passes can take a long time because each removed instruction shifts remaining instruction and auxiliary-data arrays and adjusts branch offsets. Before the fix, this work did not check for signals or reschedule, so even a pending SIGKILL could not terminate the loader until rewriting completed.
What changes with the fix?
The affected rewrite helpers gain cancellation and rescheduling points, allowing long rewrite operations to respond to interruption and yield execution. Interrupted constant blinding is reported as -EINTR and propagated through both JIT paths, including kernels that allow interpreter fallback.