CVE-2026-98085

Awaiting Analysis Awaiting Analysis - Queue

BPF Precision Backtracking Flaw in Linux Kernel

Publication date: 2026-09-25

Last updated on: 2026-10-15

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPF_LD | BPF_{IND,ABS} instructions. These instructions are modelled as two branches: - fallthrough; - implicit exit from current subprogram. The implicit exit case was not handled by the backtrack_insn() function. When backtracking such a path backtrack_insn() did not call bt_subprog_enter(), which meant that backtracking continued manipulating precision marks in a caller frame, while looking at instructions in a callee frame. This lead to segmentation faults during verification (see the selftest), or unsound state pruning.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-15

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-98085

EUVD

EUVD-2026-86915

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. It involves a bug in the precision backtracking mechanism for specific BPF instructions (BPF_LD | BPF_IND,ABS). These instructions have two branches: fallthrough and an implicit exit from the current subprogram. The backtrack_insn() function failed to handle the implicit exit case properly, causing it to manipulate precision marks in the wrong frame while examining instructions in another frame. This leads to crashes during verification or incorrect state pruning.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) implementation and requires kernel-level inspection. Detection involves checking kernel logs for verification failures or segmentation faults related to BPF operations. Use commands like 'dmesg | grep -i bpf' or 'journalctl -k | grep -i segfault' to identify crashes. If you suspect exploitation, review BPF-related processes with 'ps aux | grep -i bpf'.

Impact Analysis

This vulnerability could cause the Linux kernel to crash with a segmentation fault during BPF program verification. It may also lead to incorrect pruning of program states, potentially allowing invalid BPF programs to pass verification when they should not. Users relying on BPF for networking, security, or other kernel-level tasks could experience system instability or security bypasses.

Compliance Impact

This vulnerability in the Linux kernel could lead to segmentation faults or unsound state pruning during BPF program verification. While it does not directly impact compliance with standards like GDPR or HIPAA, such kernel-level issues may affect system stability and security, potentially compromising data integrity or availability required by these regulations.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this CVE. If immediate patching is not possible, disable BPF JIT compilation by setting 'net.core.bpf_jit_enable=0' in sysctl or kernel parameters. Monitor kernel logs for BPF-related errors post-update.

Hi! I’m here to help you understand CVE-2026-98085. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70