CVE-2026-98611
Received
Received - Intake
Buffer Size Validation Bypass in Linux Kernel BPF
Vulnerability report for CVE-2026-98611, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-18
Last updated on: 2026-10-18
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Check params size before reading reserved fields
bpf_crypto_ctx_create() is a kfunc whose second argument is declared
with the __sz annotation, so the verifier only guarantees that
params__sz bytes of params are valid. The function nevertheless reads
params->reserved[0] and params->reserved[1] (offsets 14 and 15) before
comparing params__sz against the size of struct bpf_crypto_params, so a
BPF program can pass a shorter buffer and have the kernel read past the
region that was validated for it.
Move the size check in front of the reserved field reads.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | 3e1c6f35409f9e447bf37f64840f5b65576bfb78 |
| Linux | Linux | 3e1c6f35409f9e447bf37f64840f5b65576bfb78 |
| Linux | Linux | 3e1c6f35409f9e447bf37f64840f5b65576bfb78 |
| Linux | Linux | 3e1c6f35409f9e447bf37f64840f5b65576bfb78 |
| Linux | Linux | 6.10 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
