CVE-2026-98856: kprobes: Skip disarmed probes when checking optkprobe overlap
In the Linux kernel, the following vulnerability has been resolved:
kprobes: Skip disarmed probes when checking optkprobe overlap
On x86, an optkprobe at A replaces five bytes with a jump. If a disabled probe B is at A+2, getoptimizedkprobe() stops at B when arming a new probe C at A+4. It leaves A optimized:
A A+1 A+2 A+3 A+4 A's jump | e9 | d0 | d1 | d2 | d3 | after C | e9 | d0 | d1 | d2 | cc |
The INT3 for C overwrites the last byte of A's jump displacement, so execution can jump to the wrong address. B can have prepared optinsns while disarmed, but has no jump to unoptimize.
Continue past disarmed and unprepared probes to find the active optimized probe before arming a probe in its jump.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
The issue is specific to x86 optkprobes. An active optimized probe must have replaced five bytes with a jump, a disabled probe must lie within that jump range, and a new probe must then be armed at a later byte within the same jump.
What is the practical effect when the condition is triggered?
Arming the new probe can place an INT3 instruction over the final byte of the active optkprobe's jump displacement. Execution may then jump to an incorrect address.
How is the issue addressed?
The fix makes the overlap check continue past disarmed and unprepared probes so it can find the active optimized probe before arming another probe within its jump range.