CVE-2026-98084
Received Received - Intake

BPF Loop Verifier Precision Issue in Linux Kernel

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks When processing calls to bpf_loop() verifier marks R1 (and R4) as precise. R1 tracks loop iterations number and because of the 'callback_depth < R1' mechanics in check_helper_call() must be marked precise. However, precision propagation for R1 was broken, when bpf_loop() call was verified on a second iteration. Consider the following verification trace: - main: bpf_loop(nr_loops, callback ...) - callback: BPF_EXIT - main: bpf_loop(nr_loops, callback ...) - ... While the first visit of the call to bpf_loop() propagated R1 precision as expected, the second call to mark_chain_precision() in the check_helper_call() set R1, but it was immediately reset when backtrack_insn() processed preceding BPF_EXIT in the loop deleted in this patch. Because of that, the second visit of the call to bpf_loop() injected checkpoint with R1 not marked as precise. Which could trick the verifier into accepting unsafe programs. See the next patch for an example of such program. Commit is structured in a way to minimize conflicts when 'bpf' would be eventually merged with 'bpf-next'.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98084
EUVD
EUVD-2026-86914

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the BPF (Berkeley Packet Filter) verifier. It involves incorrect precision tracking of register R1 during verification of bpf_loop() calls. When bpf_loop() is processed multiple times, the verifier fails to properly mark R1 as precise on the second iteration, potentially allowing unsafe BPF programs to pass verification.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) subsystem and requires kernel-level inspection. Detection involves checking the kernel version and BPF verifier behavior. Use commands like 'uname -a' to check kernel version and 'dmesg | grep bpf' to look for BPF-related errors. If you suspect exploitation, monitor for unusual BPF program behavior or crashes.

Impact Analysis

This vulnerability could allow malicious or poorly written BPF programs to bypass kernel security checks. If exploited, it might enable unauthorized access, privilege escalation, or denial-of-service attacks on systems running vulnerable Linux kernels.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve the BPF verifier issue. If patching is not immediately possible, consider disabling BPF JIT compilation by setting 'net.core.bpf_jit_enable=0' temporarily. Restrict unprivileged BPF usage via kernel parameters like 'kernel.unprivileged_bpf_disabled=1'.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98084. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart