CVE-2026-98647
Received Received - Intake

Divide-by-zero in Linux Kernel BPF

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix divide-by-zero in btf_struct_walk() When an access goes past the struct and the last member is a flexible array, btf_struct_walk() folds the offset back into a single element with (off - moff) % t->size, but never checks that the element type has a size. BTF takes an empty struct, so this in program BTF /* event could be empty */ struct event { #ifdef HAVE_TIMESTAMP __u64 ts; #endif }; struct batch { int nr; struct event events[]; }; divides by zero at prog load time. Getting there needs a PTR_TO_BTF_ID that is not MEM_ALLOC, e.g. a plain read of a local kptr stashed in a map from a sleepable program. Oops: divide error: 0000 [#1] SMP KASAN PTI RIP: 0010:btf_struct_walk+0x53f/0x1570 Call Trace: <TASK> btf_struct_access+0x42a/0xcd0 check_ptr_to_btf_access+0x4dc/0x1160 check_mem_access+0x3a45/0x8740 check_load_mem+0x36a/0xd10 do_check_common+0x3ef0/0xb210 bpf_check+0x6d3b/0x8580 bpf_prog_load+0xf7c/0x2720 __sys_bpf+0xa83/0x3690 __x64_sys_bpf+0xc7/0x150 x64_sys_call+0x1f3f/0x27e0 do_syscall_64+0xe5/0x610 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> Reject a zero-sized element type. The fixed array path in the same function already bails out on the same thing: btf_struct_walk() ... /* skip empty array */ if (moff == mtrue_end) continue; msize /= total_nelems;

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98647
EUVD
EUVD-2026-103561

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
Linux Linux 9c5f8a1008a121e4c6b24af211034e24b0b63081
Linux Linux 9c5f8a1008a121e4c6b24af211034e24b0b63081
Linux Linux 9c5f8a1008a121e4c6b24af211034e24b0b63081
Linux Linux 9c5f8a1008a121e4c6b24af211034e24b0b63081
Linux Linux 9c5f8a1008a121e4c6b24af211034e24b0b63081
Linux Linux 9c5f8a1008a121e4c6b24af211034e24b0b63081
Linux Linux 9c5f8a1008a121e4c6b24af211034e24b0b63081
Linux Linux 5.8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a divide-by-zero error in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. It occurs in the btf_struct_walk() function when processing BTF (BPF Type Format) data. The issue arises when accessing a struct with a flexible array member where the last member is empty, leading to a division by zero during offset calculation.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) implementation. Detection requires checking the kernel version and BPF-related logs. Use 'uname -r' to check the kernel version and look for divide-by-zero errors in kernel logs with 'dmesg | grep divide' or 'journalctl -k | grep divide'.

Impact Analysis

This vulnerability can cause a kernel crash (oops) due to a divide-by-zero error. It may lead to system instability or denial of service if exploited. The issue requires specific conditions like a PTR_TO_BTF_ID not from memory allocation, such as reading a local kptr from a sleepable program.

Mitigation Strategies

Apply the latest kernel update that includes the fix for CVE-2026-98647. If immediate patching is not possible, restrict unprivileged BPF program loading by setting 'kernel.unprivileged_bpf_disabled=1' via sysctl or kernel command line.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98647. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart