CVE-2026-98647: bpf: Fix divide-by-zero in btf_struct_walk()
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix divide-by-zero in btfstructwalk()
When an access goes past the struct and the last member is a flexible array, btfstructwalk() folds the offset back into a single element with (off - moff) % t->size, but never checks that the element type has a size.
BTF takes an empty struct, so this in program BTF
/ event could be empty / struct event { #ifdef HAVETIMESTAMP u64 ts; #endif };
struct batch { int nr; struct event events[]; };
divides by zero at prog load time. Getting there needs a PTRTOBTFID that is not MEMALLOC, e.g. a plain read of a local kptr stashed in a map from a sleepable program.
Oops: divide error: 0000 [#1] SMP KASAN PTI RIP: 0010:btfstructwalk+0x53f/0x1570 Call Trace: <TASK> btfstructaccess+0x42a/0xcd0 checkptrtobtfaccess+0x4dc/0x1160 checkmemaccess+0x3a45/0x8740 checkloadmem+0x36a/0xd10 docheckcommon+0x3ef0/0xb210 bpfcheck+0x6d3b/0x8580 bpfprogload+0xf7c/0x2720 sysbpf+0xa83/0x3690 x64sysbpf+0xc7/0x150 x64syscall+0x1f3f/0x27e0 dosyscall64+0xe5/0x610 entrySYSCALL64afterhwframe+0x76/0x7e </TASK>
Reject a zero-sized element type. The fixed array path in the same function already bails out on the same thing:
btfstructwalk() ... / skip empty array / if (moff == mtrueend) continue;
msize /= totalnelems;
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the fault?
A crafted BPF program must cause btf_struct_walk() to access beyond a structure whose final member is a flexible array with a zero-sized element type, such as an empty structure. The path also requires a PTR_TO_BTF_ID that is not MEM_ALLOC; the description gives a plain read of a local kptr stored in a map from a sleepable program as an example.
At what stage does the issue occur and what is the impact?
The divide-by-zero occurs while the kernel verifies and loads the BPF program, before the program runs. The supplied trace shows a kernel divide-error oops during bpf_prog_load().
How can the issue be mitigated if the fix cannot be applied immediately?
Avoid loading BPF programs that use the affected access pattern: out-of-bounds traversal into a flexible array whose element type can be an empty structure, combined with a non-MEM_ALLOC PTR_TO_BTF_ID. In particular, avoid the described local-kptr map access from sleepable BPF programs.
How does the fix prevent the crash?
The fix rejects flexible-array element types with zero size before performing the modulo operation that would otherwise divide by that size.