CVE-2026-98075bpf: reject BPF_PSEUDO_FUNC reference to the main program
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: bpf: reject BPF_PSEUDO_FUNC reference to the main program fixups.c:jit_subprogs() rewrites BPF_PSEUDO_FUNC loads to contain real function addresses. This function is invoked from bpf_jit_subprogs() only when env->subprog_cnt > 1. Meaning that for any program like below: int main(void *ctx) { void *ptr = main; ... bpf_timer_set_callback(..., ptr); ... } The 'ptr' won't be ever converted to contain an address. In combination with e.g. bpf_timer_set_callback() this would lead to a function call at a bogus address. Instead of complicating the implementation, just assume that no useful program needs main to be a sync or async callback and reject BPF_PSEUDO_FUNC loads for the main subprogram.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Undergoing Analysis
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 69c087ba6225b574afb6e505b72cb75242a3d844 before c74750dca96f40a1adb9d334f5a3152f44b270c3; from 69c087ba6225b574afb6e505b72cb75242a3d844 before 314c8caa9cb64ad60c5b969fe9a3e2dcdccf156f; 69c087ba6225b574afb6e505b72cb75242a3d844 builds before 8cb75f7ada25b1cf25f2f74dec3ba649b9064a09; from 69c087ba6225b574afb6e505b72cb75242a3d844 before 118212417ba0120d99f84154799f8880f07411f4; from 69c087ba6225b574afb6e505b72cb75242a3d844 before d6c39774ae093c9f7009cc4ae918f18fc1af7ae7; from 69c087ba6225b574afb6e505b72cb75242a3d844 before 92f0bd0e2b632c6565ac2214a4d7d2ed37e5b9f6; from 69c087ba6225b574afb6e505b72cb75242a3d844 before 374b2c5561db80fcdd7cdce44af37a49416f61c7 | CNA record |
References
- https://git.kernel.org/stable/c/c74750dca96f40a1adb9d334f5a3152f44b270c3
- https://git.kernel.org/stable/c/314c8caa9cb64ad60c5b969fe9a3e2dcdccf156f
- https://git.kernel.org/stable/c/8cb75f7ada25b1cf25f2f74dec3ba649b9064a09
- https://git.kernel.org/stable/c/118212417ba0120d99f84154799f8880f07411f4
- https://git.kernel.org/stable/c/d6c39774ae093c9f7009cc4ae918f18fc1af7ae7
- https://git.kernel.org/stable/c/92f0bd0e2b632c6565ac2214a4d7d2ed37e5b9f6
- https://git.kernel.org/stable/c/374b2c5561db80fcdd7cdce44af37a49416f61c7
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.