critical · CVSS v3 6.5

CVE-2026-98627

CVE-2026-98627 is a critical flaw in the Linux kernel’s BPF subsystem that allows out‑of‑bounds packet pointer accesses due to incorrect dis

Overview

CVE-2026-98627 is a critical flaw in the Linux kernel’s BPF subsystem that allows out‑of‑bounds packet pointer accesses due to incorrect displacement handling. The vulnerability can be triggered by malicious BPF programs, potentially enabling memory corruption or privilege escalation. It was fixed by a kernel commit that corrected the pointer offset logic.

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve packet pointer class displacement in regsafe() regsafe() maps packet pointer IDs between states and checks that each current register range is a subset of the corresponding explored register range. It does not, however, preserve the displacement between registers that share a packet pointer ID. This is unsound because packet range is shared by ID. A bounds check on one class member updates every member, and a later access can consume the range through another member. Commit 022ac0750883 ("bpf: use reg->var_off instead of reg->off for pointers") folded the fixed pointer offset into r64 and removed the old off equality check, so two individually narrower registers can prune even when their displacement has changed. The explored path can then license an out-of-bounds packet access on the pruned path. Require matching range bases for packet pointers with an ID. Together with the existing ID mapping, this preserves the displacement between members of each packet-pointer class without adding per-ID state. Packet pointers without an ID remain unaffected.

Impact

The flaw compromises the confidentiality, integrity, and availability of systems running vulnerable kernels. An attacker can read or write arbitrary kernel memory through crafted BPF programs, leading to privilege escalation or denial of service. Kernel developers and system administrators are directly impacted.

Remediation

Apply the latest kernel update that includes commit 022ac0750883. Verify that the kernel version is at least the patched release. If immediate update is not possible, disable BPF JIT or restrict BPF program loading using seccomp or kernel configuration options. Monitor for anomalous BPF activity and audit BPF program signatures.

Risk context

The vulnerability is rated critical with a CVSS v3 score of 6.5. While no EPSS data is available, the severity indicates a high risk to affected systems. Defenders should treat this as a high‑priority patching issue.

Affected products

  • Linux kernel
  • Ubuntu kernel
  • Red Hat kernel
  • Fedora kernel
  • Debian kernel
  • CentOS kernel
  • OpenSUSE kernel
  • Android kernel

Scores

Severity
critical
CVSS v2
9.4
CVSS v3
6.5
CVSS v4
—
EPSS
—

Linux BPF Kernel Out-of-bounds Privilege Escalation Critical Memory Corruption

← All CVEs

Related CVEs

critical

CVE-2026-98620

A critical kernel bug in the MediaTek Ethernet driver (mtk_eth_soc) causes a BUG_ON when register_netdev() fails, potentially leading to a kernel panic. The flaw occurs during probe failure handling, leaving net_devices in a registered state before they are freed. This can disrupt network services and overall system stability.

View analysis

critical

CVE-2026-98628

In the Linux kernel, the following vulnerability has been resolved: bpf: Make post-verification instruction rewrites killable After do_check() returns, the verifier runs several instruction rewrite passes. Some of them patch or remove one instruction at a time. Each operation moves the remaining instruction and auxiliary-data arrays and adjusts all branch offsets, making the overall work quadratic in the program length. A privileged loader can submit 131072 unconditional jumps by zero followed by a valid return. Verification finishes quickly, but bpf_opt_remove_nops() then spends a long time removing each jump separately. Since this post-verification work neither checks for signals nor reschedules, a pending SIGKILL cannot terminate the task until the rewrite finishes. Make bpf_patch_insn_data() and verifier_remove_insns() common cancellation and rescheduling points. These helpers run from BPF_PROG_LOAD process context, and bpf_patch_insn_data() can already sleep while reallocating auxiliary data. Report interrupted constant blinding as -EINTR and propagate it through both JIT paths, including kernels that permit interpreter fallback. Other blinding failures retain the existing fallback behavior. This does not reduce the quadratic cost of the rewrite passes, but it makes the work preemptible and allows a killed loader to be torn down promptly.

View analysis

critical

CVE-2026-98634

In the Linux kernel, the following vulnerability has been resolved: scsi: sd_zbc: Reject disks with too many zones sd_zbc_read_zones() computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nr_zones field of struct zoned_disk_info, silently truncating counts that exceed 32 bits. The truncated count is later used to size per-zone resources, while the device may still report more zones than fit. Moreover, sd_zbc_report_zones() counts the reported zones with a signed int zone_idx, which overflows past INT_MAX. Reject devices reporting more than INT_MAX zones at scan time; such a device is not realistic for any medium that exists today, and accepting it produces inconsistent zone bookkeeping.

View analysis

critical

CVE-2026-98652

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Add missing srcu in kvm_s390_set_irq_state() Like kvm_s390_inject_vcpu(), kvm_s390_set_irq_state() also needs the kvm->srcu or the slots lock when performing the Store status operation. Fix by taking kvm->srcu in kvm_s390_set_irq_state().

View analysis