CVE-2026-98007

Received Received - Intake

BPF Loop Non-Scalar Argument Rejection

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-scalar bpf_loop iteration counts bpf_loop() declares its nr_loops argument as ARG_ANYTHING. Privileged programs may pass pointer values to such arguments, so check_func_arg() lets a pointer-valued R1 reach the helper-specific checks. Since commit bb124da69c47 ("bpf: keep track of max number of bpf_loop callback iterations"), the verifier marks R1 precise and reads its upper bound to limit callback simulation. Precision backtracking only accepts scalar registers, so passing a pointer instead triggers the "backtracking misuse" verifier warning. Kernels with panic_on_warn enabled subsequently panic. Introduce ARG_SCALAR for helper arguments that only accept scalar values and use it for bpf_loop() nr_loops. Generic helper argument validation then rejects pointers before loop inlining and precision processing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-98007

EUVD

EUVD-2026-86660

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the bpf_loop() function where non-scalar iteration counts can cause a verifier warning. If a privileged program passes a pointer instead of a scalar value to nr_loops, the verifier may trigger a 'backtracking misuse' warning. Systems with panic_on_warn enabled could then crash.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF subsystem and may not have direct network detection methods. Check kernel logs for verifier warnings related to bpf_loop or backtracking misuse. Commands like dmesg | grep -i bpf or journalctl -k | grep -i bpf may help identify issues.

Impact Analysis

This vulnerability could allow a privileged local attacker to cause a kernel panic by exploiting the bpf_loop() function with a pointer value. This may lead to denial-of-service conditions on affected systems.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a kernel-level issue in the Linux bpf_loop() function that could cause system crashes under specific conditions, but does not involve data exposure or privacy violations.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this BPF vulnerability. Monitor kernel logs for any BPF-related errors post-update. If using custom BPF programs, ensure nr_loops arguments are scalar values to avoid verifier issues.

Hi! I’m here to help you understand CVE-2026-98007. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70