CVE-2026-98007

Overview

CVE-2026-98007 is a Linux kernel BPF verifier issue where bpf_loop() accepted non-scalar iteration counts. A privileged BPF program could trigger a verifier warning, and kernels configured with panic_on_warn may panic. It matters because it can cause denial of service on systems that load BPF programs.

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-scalar bpf_loop iteration counts bpf_loop() declares its nr_loops argument as ARG_ANYTHING. Privileged programs may pass pointer values to such arguments, so check_func_arg() lets a pointer-valued R1 reach the helper-specific checks. Since commit bb124da69c47 ("bpf: keep track of max number of bpf_loop callback iterations"), the verifier marks R1 precise and reads its upper bound to limit callback simulation. Precision backtracking only accepts scalar registers, so passing a pointer instead triggers the "backtracking misuse" verifier warning. Kernels with panic_on_warn enabled subsequently panic. Introduce ARG_SCALAR for helper arguments that only accept scalar values and use it for bpf_loop() nr_loops. Generic helper argument validation then rejects pointers before loop inlining and precision processing.

Impact

Availability is the primary impact: a local privileged actor able to load BPF programs may cause a kernel panic on affected kernels with panic_on_warn enabled. Confidentiality and integrity are not indicated by the description. Impacted systems include Linux hosts with BPF enabled, especially those running privileged BPF workloads or containers with BPF capabilities.

Remediation

Apply a kernel update from the vendor that rejects non-scalar bpf_loop() iteration counts using ARG_SCALAR. If patching is delayed, set kernel.panic_on_warn=0 to prevent the verifier warning from causing a panic, and restrict BPF loading to trusted administrators by limiting CAP_BPF/CAP_SYS_ADMIN and disabling unprivileged BPF where supported. Audit and monitor BPF program loading and verifier warnings for unexpected activity.

Risk context

CVSS v3 is 5.5 (medium) and no EPSS score is provided. Treat as moderate urgency, prioritizing systems where privileged BPF is used and panic_on_warn is enabled. No evidence of active exploitation is indicated in the provided data.

Affected products

• Linux kernel
• Linux kernel BPF subsystem
• Distributions shipping Linux kernel