CVE-2026-98628

Received Received - Intake

BPF Verifier Post-Verification Rewrite DoS

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Make post-verification instruction rewrites killable After do_check() returns, the verifier runs several instruction rewrite passes. Some of them patch or remove one instruction at a time. Each operation moves the remaining instruction and auxiliary-data arrays and adjusts all branch offsets, making the overall work quadratic in the program length. A privileged loader can submit 131072 unconditional jumps by zero followed by a valid return. Verification finishes quickly, but bpf_opt_remove_nops() then spends a long time removing each jump separately. Since this post-verification work neither checks for signals nor reschedules, a pending SIGKILL cannot terminate the task until the rewrite finishes. Make bpf_patch_insn_data() and verifier_remove_insns() common cancellation and rescheduling points. These helpers run from BPF_PROG_LOAD process context, and bpf_patch_insn_data() can already sleep while reallocating auxiliary data. Report interrupted constant blinding as -EINTR and propagate it through both JIT paths, including kernels that permit interpreter fallback. Other blinding failures retain the existing fallback behavior. This does not reduce the quadratic cost of the rewrite passes, but it makes the work preemptible and allows a killed loader to be torn down promptly.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98628

EUVD

EUVD-2026-103542

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	52875a04f4b26e7ef30a288ea096f7cfec0e93cd
Linux	Linux	52875a04f4b26e7ef30a288ea096f7cfec0e93cd
Linux	Linux	5.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a denial-of-service issue in the BPF verifier. After verification, the verifier performs instruction rewrite passes that can take quadratic time relative to program length. A malicious privileged loader can exploit this by submitting a large number of unconditional jumps, causing the rewrite process to hang indefinitely without checking for signals like SIGKILL, preventing task termination.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF verifier and does not have a direct network detection method. Detection involves checking the kernel version and BPF-related processes. Use 'uname -r' to check the kernel version and look for signs of excessive CPU usage in BPF-related processes. Monitor for processes stuck in 'D' state (uninterruptible sleep) during BPF program loading.

Impact Analysis

If exploited, this vulnerability can cause system hangs or slowdowns during BPF program loading, potentially leading to denial-of-service conditions. A privileged attacker could trigger prolonged CPU usage, affecting system responsiveness and availability.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a denial-of-service issue in the Linux kernel's BPF verifier that allows a privileged loader to cause excessive CPU usage during verification. Compliance impacts would only occur if the vulnerability were exploited to disrupt system availability, potentially affecting data processing or access.

Mitigation Strategies

Apply the latest kernel security patches from your Linux distribution. If immediate patching is not possible, restrict BPF usage by unloading unnecessary BPF programs and limiting access to BPF functionality via kernel command line parameters like 'sysctl kernel.unprivileged_bpf_disabled=1'. Monitor system logs for BPF-related errors or hangs.

Hi! I’m here to help you understand CVE-2026-98628. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70