CVE-2026-98044bpf: Reject legacy packet loads from callbacks
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject legacy packet loads from callbacks check_ld_abs() models a failed BPF_LD_ABS or BPF_LD_IND in a subprogram as an implicit return with R0 set to zero. It calls prepare_func_exit() to explore this synthesized path. When the load is reached directly from a synchronous callback, prepare_func_exit() enforces the callback return contract and marks R0 precise. R0 is not derived from a real instruction on this path, so precision backtracking reaches the callback call with R0 still requested and triggers the "callback unexpected regs" verifier bug. A privileged program loader can therefore cause a verifier warning and an -EFAULT BPF_PROG_LOAD. These legacy packet-load instructions are deprecated. Reject them from callbacks rather than complicating their implicit-return model. Check all active frames before constructing the implicit return so nested static subprograms cannot hide the callback context. Global functions are verified independently with a fresh frame zero, so an active-frame check cannot identify a global function called from a callback. Also check the complete subprogram call graph during stack-depth validation and reject a function containing a legacy load when any caller is a callback. This covers global and static descendants without making has_ld_abs transitive, preserving its per-function BTF return-type check. Ordinary uses outside callbacks remain supported.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337 before 3484a99303912db62428494a9061212049027e57; from ee861486e377edc55361c08dcbceab3f6b6577bd before bc489c0c9b8c86bd7fac42cfd1bb152f042fca56; from ee861486e377edc55361c08dcbceab3f6b6577bd before e7d28823c662128caae63f14e16bd394916c139b; 928d354ae3557e8f755a227e67be88034eb3cd7f; 8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbe; de1055e7f9e67af32b1f3376066272b04e5223c0; 37ad2bb11e9de92cb7b94548705eeedd87f7d392; 8674e2db06cff6b50f2216eed9a761d15425bb34; and 8 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/3484a99303912db62428494a9061212049027e57
- https://git.kernel.org/stable/c/bc489c0c9b8c86bd7fac42cfd1bb152f042fca56
- https://git.kernel.org/stable/c/e7d28823c662128caae63f14e16bd394916c139b
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.