From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 44D71496D2A for ; Fri, 25 Sep 2026 10:36:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790332588; cv=none; b=OX3MYG3aZK/r1DwwFuO0yMXOCYLDYTU/3pyPtAWJhzWW/1K5B5lecKkumYAbMRmNQD8ryjB0LJL7OhrskBazNRjNr7uVqizQfm/gzx7Lo/JUCSctkm9dmy6feWOQ+rwJqNFxq3mob8ASYm5h+mW5M9wijmGtNhGJZ1bk5lcRhxE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790332588; c=relaxed/simple; bh=hlxKyAfqi1GivSzk5lcLm+0g6DShF0nyaQ/mXHGb54o=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=m7EDquNaDVjahCaVMi8SgcbWejHnuLomAjKQz5susmFnoMxyRbEuWb+zlQFQT7xQ2/xVRXG96pfVoCNVqbUIndNgj0RoxPsHSp51F4TXbe8ed5L21iYHGe+8vwDMl5XlMNygTqsC5yre95pkszMU92p5UCpjG6opda2bubTQaew= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=mIz/rw/R; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="mIz/rw/R" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 99F0D1F000FF; Fri, 25 Sep 2026 10:36:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1790332587; bh=msFMMXzecqUngWjxl3u37y+HBrCJzy7E65g6UeHhhdc=; h=From:To:Cc:Subject:Date:Reply-To; b=mIz/rw/RtuJhf/pDgqZKL395mtMlI21uLL1uvzuj/1aU9QNaK8qgQtUIF+T1d6z4g G8dk7hQ8YC9ysu1bAJ3IrwS18vNrsmzOyZEY6aSxtRhAgful4VI1XnMqbVMCWLPQ8D izhwX0Z3nYf7aAfXHXKVbJeAGYRzPQm+7rpoR3j8= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-98044: bpf: Reject legacy packet loads from callbacks Date: Fri, 25 Sep 2026 12:25:46 +0200 Message-ID: <2026092531-CVE-2026-98044-efcb@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3865; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=+qVQfWqRk/e4GyLJGexDsbJsB+CH7aHMFyNhRGjYQyw=; b=owGbwMvMwCRo6H6F97bub03G02pJDFnbvNPLK69zBOe/Pl28vikx/+ubhkWzDtp4rXM8+jlCg ONY8pRTHbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjCRP7MY5lnfX3xReaPE266+ s7mN3HW/LwR9es4wP3dS5mkf5qq42vCW9Sr6cxXvbz+nCgA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: bpf: Reject legacy packet loads from callbacks check_ld_abs() models a failed BPF_LD_ABS or BPF_LD_IND in a subprogram as an implicit return with R0 set to zero. It calls prepare_func_exit() to explore this synthesized path. When the load is reached directly from a synchronous callback, prepare_func_exit() enforces the callback return contract and marks R0 precise. R0 is not derived from a real instruction on this path, so precision backtracking reaches the callback call with R0 still requested and triggers the "callback unexpected regs" verifier bug. A privileged program loader can therefore cause a verifier warning and an -EFAULT BPF_PROG_LOAD. These legacy packet-load instructions are deprecated. Reject them from callbacks rather than complicating their implicit-return model. Check all active frames before constructing the implicit return so nested static subprograms cannot hide the callback context. Global functions are verified independently with a fresh frame zero, so an active-frame check cannot identify a global function called from a callback. Also check the complete subprogram call graph during stack-depth validation and reject a function containing a legacy load when any caller is a callback. This covers global and static descendants without making has_ld_abs transitive, preserving its per-function BTF return-type check. Ordinary uses outside callbacks remain supported. The Linux kernel CVE team has assigned CVE-2026-98044 to this issue. Affected and fixed versions =========================== Issue introduced in 6.18.42 with commit ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337 and fixed in 6.18.53 with commit 3484a99303912db62428494a9061212049027e57 Issue introduced in 7.1 with commit ee861486e377edc55361c08dcbceab3f6b6577bd and fixed in 7.2.7 with commit bc489c0c9b8c86bd7fac42cfd1bb152f042fca56 Issue introduced in 7.1 with commit ee861486e377edc55361c08dcbceab3f6b6577bd and fixed in 7.3-rc2 with commit e7d28823c662128caae63f14e16bd394916c139b Issue introduced in 5.10.265 with commit 928d354ae3557e8f755a227e67be88034eb3cd7f Issue introduced in 5.15.216 with commit 8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbe Issue introduced in 6.1.183 with commit de1055e7f9e67af32b1f3376066272b04e5223c0 Issue introduced in 6.6.148 with commit 37ad2bb11e9de92cb7b94548705eeedd87f7d392 Issue introduced in 6.12.101 with commit 8674e2db06cff6b50f2216eed9a761d15425bb34 Issue introduced in 7.0.10 with commit d846d83bdacbd8f14fc45c63b8c1d22608452e1c Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-98044 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: kernel/bpf/verifier.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/3484a99303912db62428494a9061212049027e57 https://git.kernel.org/stable/c/bc489c0c9b8c86bd7fac42cfd1bb152f042fca56 https://git.kernel.org/stable/c/e7d28823c662128caae63f14e16bd394916c139b