From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D49CC37E317 for ; Sun, 18 Oct 2026 15:33:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792337627; cv=none; b=h7hzcfAD8K0iwnjxPR0Uu+lWNVTrgJ9HVWAvoaBw0Kyo9X+3YPKou8CeLMrnQAKFyAmaH1HM5WwkzM8bQHcvymvbejB+AI0bavbsy/WZVDU+ooeJe7f/ccKlM3Azm7ZlvMbbSjjydOoRQ6dCe1fRDIC7dUpVi3UNSG4eFzJTLiA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792337627; c=relaxed/simple; bh=PWTADo3351XCeSbeUuqCfF+Z3rbmHdXRsyNADFxMIOw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=mkujB5jxgGcA/VktYQAe5B/4XqLXTSsyzwDz/xbIoxhseKxfcKnoeZuYSBR8vnrieSQqO7FwdW9qXAvRusSoE+sG2yx/QmrfDyU/fEHfKSw7RpDOsQYY5Td61ZnOoNIFeDSnKWgBWiq7r3kFYiML90TYCd6NZXKcOHId5HkjBiU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=dYWCgTeU; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="dYWCgTeU" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 154D61F000C4; Sun, 18 Oct 2026 15:33:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1792337625; bh=03lbuhtCslD6DOC4MCYc2D0hUOzkh/S5vV7a8LUqhEA=; h=From:To:Cc:Subject:Date:Reply-To; b=dYWCgTeUWMZwKMS0EmXM8sfsNIkEyg2DnRVIA1KMtkSNTk9PUB5piJsFAhttPuFIr v8j4OAUgFhv0xL3h0ZPDYpOa4x7EdzKReLm8/19RmD1aUExMvv4Acqgs8j1i/SkCM6 L2CuYJOZ/mKkrp4v6rWeFZd2h9Ht8TmJ1EEtniPc= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-98613: bpf: Bound ownership depth through local kptrs and graph roots Date: Sun, 18 Oct 2026 17:17:57 +0200 Message-ID: <2026101840-CVE-2026-98613-b229@gregkh> X-Mailer: git-send-email 2.56.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4521; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=HL4zxqZpyV1rfhIyWr9WojOO0LLniN9wFJqAwNZNoM8=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlXHs2R8s0/uHrfrnzjW6xJVQvfv5980K/Gpv6qc0v1j J2+u0V0OmJZGASZGGTFFFm+bOM5ur/ikKKXoe1pmDmsTCBDGLg4BWAiR9IZ5sdeYGHrs8/5PMGX d2bs+8nXLHsXyzDMj1KsDppctKip4l1Z0S3TlMVPLmiWAAA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: bpf: Bound ownership depth through local kptrs and graph roots Program-allocated objects can own other local objects through referenced kptrs. bpf_obj_free_fields() follows those pointers through __bpf_obj_drop_impl() synchronously, before the object storage is freed through RCU. A self-referential local kptr type therefore permits arbitrarily deep object chains, and dropping the head can exhaust the kernel stack. Long acyclic type chains have the same problem. btf_check_and_fixup_fields() still assumes referenced kptrs only point to kernel types and checks ownership through list and rbtree roots only. Its existing rule is sufficient for graph-only cycles: the target of each graph edge must contain a node, so every type in a cycle has both a root and a node. The rule rejects such a type owning another root, breaking every cycle. It also limits graph-only chains to three types, or two if the first type contains a node, and conservatively rejects longer acyclic chains. The missing local-kptr edges, rather than a missed graph-only cycle, are the bug introduced by support for bpf_kptr_xchg() into local kptrs. Replace that restriction with one bounded ownership walk covering graph roots and local referenced kptrs. Run it after all BTF records have been fixed up, reject cycles and paths deeper than eight record-bearing types, and cache each type's suffix depth while checking it against the remaining budget. This also permits the longer acyclic graph-only layouts rejected by the old rule; update their existing BTF tests accordingly. Keep the bound independent of MAX_CALL_FRAMES because recursive destruction can run below a BPF call chain. A plain local pointee without special-field metadata adds only a final non-recursing drop. Non-owning kptrs and kernel-BTF kptrs do not recurse through local records and remain outside the walk. Include local percpu-kptr edges too, although allocation of percpu objects with special fields is currently forbidden, so that relaxing that restriction cannot bypass the ownership bound. btf_check_and_fixup_fields() continues to initialize graph_root.value_rec, including for separately allocated map records. The ownership relationships belong to immutable program BTF and only need validation at BTF load time. The Linux kernel CVE team has assigned CVE-2026-98613 to this issue. Affected and fixed versions =========================== Issue introduced in 6.12 with commit b0966c724584a5a9fd7fb529de19807c31f27a45 and fixed in 6.12.112 with commit 92aa0502c781d72bb9685245c3280efb3766a110 Issue introduced in 6.12 with commit b0966c724584a5a9fd7fb529de19807c31f27a45 and fixed in 6.18.55 with commit 9c11e543fec32e92b3aa3f693339ca3ee79ea9dd Issue introduced in 6.12 with commit b0966c724584a5a9fd7fb529de19807c31f27a45 and fixed in 7.2.9 with commit 4105870a4b8afe852aeb24a6dd58e1836cc4ce58 Issue introduced in 6.12 with commit b0966c724584a5a9fd7fb529de19807c31f27a45 and fixed in 7.3-rc5 with commit bfc888f04588f591851e95c974954cfca58e6c19 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-98613 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: kernel/bpf/btf.c tools/testing/selftests/bpf/prog_tests/linked_list.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/92aa0502c781d72bb9685245c3280efb3766a110 https://git.kernel.org/stable/c/9c11e543fec32e92b3aa3f693339ca3ee79ea9dd https://git.kernel.org/stable/c/4105870a4b8afe852aeb24a6dd58e1836cc4ce58 https://git.kernel.org/stable/c/bfc888f04588f591851e95c974954cfca58e6c19