CVE-2026-98085bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPF_LD | BPF_{IND,ABS} instructions. These instructions are modelled as two branches: - fallthrough; - implicit exit from current subprogram. The implicit exit case was not handled by the backtrack_insn() function. When backtracking such a path backtrack_insn() did not call bt_subprog_enter(), which meant that backtracking continued manipulating precision marks in a caller frame, while looking at instructions in a callee frame. This lead to segmentation faults during verification (see the selftest), or unsound state pruning.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Undergoing Analysis
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337 before a0cd9e22f8faed30a8da8be357c51bd8b3074ee9; from ee861486e377edc55361c08dcbceab3f6b6577bd before 671b7b9a660ef15b25faa3df161205b9dc8d1eb2; from ee861486e377edc55361c08dcbceab3f6b6577bd before 387b1baefbb776e3f48dc2261e77a49213f470f7; 928d354ae3557e8f755a227e67be88034eb3cd7f; 8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbe; de1055e7f9e67af32b1f3376066272b04e5223c0; 37ad2bb11e9de92cb7b94548705eeedd87f7d392; 8674e2db06cff6b50f2216eed9a761d15425bb34; and 8 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/a0cd9e22f8faed30a8da8be357c51bd8b3074ee9
- https://git.kernel.org/stable/c/671b7b9a660ef15b25faa3df161205b9dc8d1eb2
- https://git.kernel.org/stable/c/387b1baefbb776e3f48dc2261e77a49213f470f7
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.