UBUNTU-CVE-2026-98007: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-scalar bpfloop iteration counts bpfloop() declares its nrloops argument as ARGANYTHING. Privileged programs may pass pointer values to such arguments, so checkfuncarg() lets a pointer-valued R1 reach the helper-specific checks. Since commit bb124da69c47 ("bpf: keep track of max number of bpfloop callback iterations"), the verifier marks R1 precise and reads its upper bound to limit callback simulation. Precision backtracking only accepts scalar registers, so passing a pointer instead triggers the "backtracking misuse" verifier warning. Kernels with paniconwarn enabled subsequently panic. Introduce ARGSCALAR for helper arguments that only accept scalar values and use it for bpfloop() nrloops. Generic helper argument validation then rejects pointers before loop inlining and precision processing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which deployments are exposed to the denial-of-service condition?
The issue is relevant where privileged BPF programs can be loaded and invoked on the listed Ubuntu Linux kernel packages. A kernel panic occurs only when panic_on_warn is enabled after the verifier emits the warning.
What must an attacker or local user be able to do?
They need the ability to run a privileged BPF program that supplies a pointer value as the bpf_loop() iteration-count argument. The vulnerable verifier path then reaches precision backtracking with a non-scalar register.
How can administrators recognize attempted or successful exploitation?
The verifier can emit a "backtracking misuse" warning when processing a pointer-valued bpf_loop() iteration count. On systems with panic_on_warn enabled, that warning is followed by a kernel panic.
What changes after the fix is applied?
The kernel validates bpf_loop()'s iteration-count argument as scalar-only. Pointer values are rejected during generic helper-argument validation before loop inlining and precision processing.