CVE-2026-98061

Awaiting Analysis Awaiting Analysis - Queue

BPF Tail Call from Callback Frame Rejection

Publication date: 2026-09-25

Last updated on: 2026-09-30

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject tail calls directly from callback frames A tail call from a non-zero frame is modeled as a return from that frame. The verifier makes R0 unknown and calls prepare_func_exit() for the taken branch. When the current frame is a synchronous callback, prepare_func_exit() enforces the callback return-value contract and marks R0 precise. Since the tail-call path synthesized R0 rather than deriving it from an instruction, precision backtracking reaches the callback-calling instruction with R0 still requested and triggers the "callback unexpected regs" verifier bug. A CAP_BPF task can therefore cause a WARN and an -EFAULT BPF_PROG_LOAD. Tail calls reachable from callbacks are already rejected later by check_max_stack_depth(). Reject a tail call made directly by a callback before constructing the inconsistent return state, using the existing diagnostic. Tail calls from ordinary subprograms keep their current behavior.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-30

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-98061

EUVD

EUVD-2026-86714

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the BPF (Berkeley Packet Filter) subsystem. A tail call from a non-zero frame is incorrectly handled when the current frame is a synchronous callback. The verifier marks register R0 as unknown and enforces a return-value contract, leading to a verifier bug that triggers a WARN and an -EFAULT error during BPF_PROG_LOAD. The issue arises because the tail-call path synthesizes R0 instead of deriving it from an instruction, causing precision backtracking to fail.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) implementation. Detection requires checking the kernel version and BPF-related logs for verifier errors. Use 'uname -a' to check kernel version and 'dmesg | grep -i bpf' to look for BPF-related errors or warnings.

Impact Analysis

A user with CAP_BPF privileges could exploit this vulnerability to cause a kernel warning (WARN) and an error (-EFAULT) during BPF program loading. This could lead to system instability, crashes, or denial of service. However, the impact is limited to systems using BPF with specific callback configurations.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a technical issue within the Linux kernel's BPF verifier. It may indirectly impact compliance if exploited to cause system instability or denial of service, but no specific compliance implications are mentioned in the provided context.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve the BPF verifier issue. Avoid using BPF programs with tail calls from callback frames until patched. Monitor kernel logs for BPF-related errors after updates.

Hi! I’m here to help you understand CVE-2026-98061. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70