CVE-2026-98626
Received Received - Intake

BPF CO-RE Relocation Validation Bypass

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Restrict CO-RE poisoning to relocatable instructions CO-RE relocation records can name any instruction offset. When a relocation cannot be resolved, bpf_core_patch_insn() currently poisons its target before checking whether that instruction is a valid relocation target. Malformed metadata can therefore replace jumps, calls, exits, register-source arithmetic, or non-immediate loads instead of failing at the relocation step. Handle poisoning only after the instruction has passed the same class and operand-form checks used for a resolved relocation. Route invalid forms through the existing diagnostic and return a hard error. Keep poisoning supported instructions, including both halves of a plain ldimm64, so an unresolved relocation in dead code remains valid. Extend bpf_core_poison_insn() to poison both halves of ldimm64, and return its status directly from each validated instruction case. This avoids routing the success path through a common label and leaves the helper free to report errors. The shared relocation code applies this restriction to both libbpf and in-kernel CO-RE.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-19
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98626
EUVD
EUVD-2026-103540

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
Linux Linux d7a252708dbc950ca2064310217e8b9f85846e2f
Linux Linux d7a252708dbc950ca2064310217e8b9f85846e2f
Linux Linux d7a252708dbc950ca2064310217e8b9f85846e2f
Linux Linux d7a252708dbc950ca2064310217e8b9f85846e2f
Linux Linux d7a252708dbc950ca2064310217e8b9f85846e2f
Linux Linux d7a252708dbc950ca2064310217e8b9f85846e2f
Linux Linux d7a252708dbc950ca2064310217e8b9f85846e2f
Linux Linux 5.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of CO-RE relocation records in BPF programs. Malformed metadata could exploit the system by replacing critical instructions like jumps or calls with poisoned values instead of failing safely during relocation checks.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) subsystem and requires kernel-level inspection. Detection involves checking kernel logs for BPF-related errors or verifying if your kernel version includes the patched code. Use commands like 'uname -a' to check kernel version and 'dmesg | grep bpf' to look for BPF-related messages.

Impact Analysis

An attacker could potentially manipulate BPF programs to execute unintended code or cause system instability by exploiting unchecked relocation records. This may lead to privilege escalation or denial of service in affected systems.

Compliance Impact

The vulnerability involves improper handling of BPF CO-RE relocation records in the Linux kernel, potentially allowing malicious metadata to manipulate executable instructions. This could lead to unauthorized code execution or data access, which may impact data integrity and confidentiality. Such risks could affect compliance with GDPR (data protection) and HIPAA (health data security) by enabling unauthorized access or modification of sensitive information.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, consider disabling BPF functionality if not required, or restrict BPF usage via kernel parameters until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98626. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart