CVE-2026-98599

Received Received - Intake

BPF Stack Slot Object Validation Bypass

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-negative offsets in stack_slot_obj_get_spi() bpf_get_spi() computes (-off - 1) / BPF_REG_SIZE using C division, which truncates toward zero. For off == 0, this produces spi 0, the same index used by the valid stack slot at fp-8. stack_slot_obj_get_spi() currently checks alignment and the resulting spi bounds, but does not reject the non-negative offset itself. It can therefore validate a PTR_TO_STACK register holding fp+0 against an iterator stored at fp-8 even though the runtime receives the actual fp+0 pointer. An effectful iterator kfunc can then interpret memory outside the BPF stack as iterator state. Reject non-negative offsets before converting the offset to an spi. All valid stack objects begin at a negative offset from the frame pointer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98599

EUVD

EUVD-2026-103644

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	06accc8779c1d558a5b5a21f2ac82b0c95827ddd
Linux	Linux	06accc8779c1d558a5b5a21f2ac82b0c95827ddd
Linux	Linux	6.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the BPF (Berkeley Packet Filter) subsystem. It allows an attacker to manipulate stack slot offsets in a way that could lead to memory corruption or unauthorized access. Specifically, the issue arises when non-negative offsets are not properly rejected, enabling an effectful iterator kfunc to interpret memory outside the BPF stack as iterator state.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) implementation and requires kernel-level inspection. Detection involves checking kernel logs for BPF-related errors or verifying kernel version against patched versions. Commands like uname -a to check kernel version or dmesg | grep -i bpf to inspect BPF-related messages may help. However, no direct detection commands are provided in the context.

Impact Analysis

If exploited, this vulnerability could allow an attacker with local access to execute arbitrary code, escalate privileges, or cause a denial of service on affected systems. It primarily affects systems using BPF for packet filtering or other kernel-level operations.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level Linux kernel issue related to BPF (Berkeley Packet Filter) memory handling. Compliance impacts would depend on system-specific implementations and whether the vulnerability leads to unauthorized data access or processing.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-98599. This vulnerability is specific to the BPF stack handling in the kernel, so applying the latest kernel updates will resolve it.

Hi! I’m here to help you understand CVE-2026-98599. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70