CVE-2026-98075
Received Received - Intake

BPF_PSEUDO_FUNC Rejection in Linux Kernel

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: reject BPF_PSEUDO_FUNC reference to the main program fixups.c:jit_subprogs() rewrites BPF_PSEUDO_FUNC loads to contain real function addresses. This function is invoked from bpf_jit_subprogs() only when env->subprog_cnt > 1. Meaning that for any program like below: int main(void *ctx) { void *ptr = main; ... bpf_timer_set_callback(..., ptr); ... } The 'ptr' won't be ever converted to contain an address. In combination with e.g. bpf_timer_set_callback() this would lead to a function call at a bogus address. Instead of complicating the implementation, just assume that no useful program needs main to be a sync or async callback and reject BPF_PSEUDO_FUNC loads for the main subprogram.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98075
EUVD
EUVD-2026-86905

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the BPF (Berkeley Packet Filter) subsystem where BPF_PSEUDO_FUNC references to the main program are not properly handled. The issue occurs in jit_subprogs() which rewrites these references to real function addresses only when multiple subprograms exist. For programs referencing the main function directly, this conversion does not happen, leading to potential function calls at incorrect memory addresses when combined with functions like bpf_timer_set_callback().

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) subsystem. Detection requires checking kernel versions and BPF program configurations. Inspect kernel logs for BPF-related errors or crashes. Use commands like 'dmesg | grep -i bpf' or 'journalctl -k | grep -i bpf' to check for BPF-related issues. Verify BPF program integrity with 'bpftool prog show' and check for malformed or suspicious programs.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code or cause a system crash by triggering a function call at a bogus memory address. This may lead to denial-of-service conditions or unauthorized access if exploited in a malicious BPF program.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. Avoid using BPF_PSEUDO_FUNC references to the main program in BPF code. Review and audit BPF programs for unsafe function pointer usage. Disable or restrict BPF program execution if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98075. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart