From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2EB3235B63F for ; Sun, 18 Oct 2026 15:37:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792337834; cv=none; b=Ehjl/JkyzBO/EDakDmYTk6wg38dFeYehxWF2+80+1pO498B2yIXzyYvyjFKeNeY/vax7e08IvkP5sWKauKnm9VhrbnkDvNfav8a71cqeCKKKW0RiWq9ANWLwnOxhkbnBHQw4qE7QEtC5Cw0VczZiO8Yr+C6dhHYcc2yr5RiU7FU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792337834; c=relaxed/simple; bh=dWvCQOYUGzkTOt4UWk2AnucRvqffj5Xcu/DreJDtbKk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=anulIMu8qxnrFrquZbRMbsYYGXYjlxCoGm+t2cSh+Y56oVUWKHmfcRNlwsspwfMoaM5FZcTFLm9iFfxLniKVlXkb8ImCmCGXP8CwOYlyGcuRbsB4VsDTKxQUMSv5lxYJACwBZWB03dizXCAw8aqbi3Rb4Waj4iTliLo1ojXGsbw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=hOKzIZiR; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="hOKzIZiR" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6422C1F000C4; Sun, 18 Oct 2026 15:37:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1792337833; bh=duMpr8DDlvDUu/0fcuNm5vBZHEWYKaUhLgovclUOVQQ=; h=From:To:Cc:Subject:Date:Reply-To; b=hOKzIZiRd/3TnD0khhTPO2YSI7G1VmIBdzdqEY7vtJqeHZ4MksrQJQ/3QYvWPDVUf wQs3JJPDR5rY6B7dmHHDKmqebywbs6DLBAqFFSoADWC96dEYyGMZ6kh7xhO35C/IBJ vBWz1DMyN5bKyX4xniiumFwGue7WI1LdHnoocOaE= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-98647: bpf: Fix divide-by-zero in btf_struct_walk() Date: Sun, 18 Oct 2026 17:18:31 +0200 Message-ID: <2026101847-CVE-2026-98647-e686@gregkh> X-Mailer: git-send-email 2.56.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4224; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=4qxg3V1e0GMXqBGU2U5df7wIj1HjU1rLaMM6p0sv5M8=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlXHi3unB9SvfH3xx8vjuTtYLVq/e8q4J/3b/uljxPXn mK/JFizqiOWhUGQiUFWTJHlyzaeo/srDil6GdqehpnDygQyhIGLUwAmkh/FsKDZ1eIm447WPRfY FDS/qq2Y9XG26lyG+aVLpGWk6n1r0vwMJThcvqvJnamxAwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: bpf: Fix divide-by-zero in btf_struct_walk() When an access goes past the struct and the last member is a flexible array, btf_struct_walk() folds the offset back into a single element with (off - moff) % t->size, but never checks that the element type has a size. BTF takes an empty struct, so this in program BTF /* event could be empty */ struct event { #ifdef HAVE_TIMESTAMP __u64 ts; #endif }; struct batch { int nr; struct event events[]; }; divides by zero at prog load time. Getting there needs a PTR_TO_BTF_ID that is not MEM_ALLOC, e.g. a plain read of a local kptr stashed in a map from a sleepable program. Oops: divide error: 0000 [#1] SMP KASAN PTI RIP: 0010:btf_struct_walk+0x53f/0x1570 Call Trace: btf_struct_access+0x42a/0xcd0 check_ptr_to_btf_access+0x4dc/0x1160 check_mem_access+0x3a45/0x8740 check_load_mem+0x36a/0xd10 do_check_common+0x3ef0/0xb210 bpf_check+0x6d3b/0x8580 bpf_prog_load+0xf7c/0x2720 __sys_bpf+0xa83/0x3690 __x64_sys_bpf+0xc7/0x150 x64_sys_call+0x1f3f/0x27e0 do_syscall_64+0xe5/0x610 entry_SYSCALL_64_after_hwframe+0x76/0x7e Reject a zero-sized element type. The fixed array path in the same function already bails out on the same thing: btf_struct_walk() ... /* skip empty array */ if (moff == mtrue_end) continue; msize /= total_nelems; The Linux kernel CVE team has assigned CVE-2026-98647 to this issue. Affected and fixed versions =========================== Issue introduced in 5.8 with commit 9c5f8a1008a121e4c6b24af211034e24b0b63081 and fixed in 5.15.222 with commit 1ea3820937f8022e044c41c6e95c84b02741b45f Issue introduced in 5.8 with commit 9c5f8a1008a121e4c6b24af211034e24b0b63081 and fixed in 6.1.189 with commit 172756f02663ad45c889c001c1a8cb4082a01a05 Issue introduced in 5.8 with commit 9c5f8a1008a121e4c6b24af211034e24b0b63081 and fixed in 6.6.158 with commit 934e9ba9f8d05656a48624710be67ca4dc8482e6 Issue introduced in 5.8 with commit 9c5f8a1008a121e4c6b24af211034e24b0b63081 and fixed in 6.12.112 with commit 63af086cb5fa6f72fd924f86bea4c2194da663a2 Issue introduced in 5.8 with commit 9c5f8a1008a121e4c6b24af211034e24b0b63081 and fixed in 6.18.55 with commit 8eb4cd72daad3a9ee63d2281bbdd16ce6d9406b1 Issue introduced in 5.8 with commit 9c5f8a1008a121e4c6b24af211034e24b0b63081 and fixed in 7.2.9 with commit b8fa56722e9c43bcd59c51fe4c7edd5f4158a11b Issue introduced in 5.8 with commit 9c5f8a1008a121e4c6b24af211034e24b0b63081 and fixed in 7.3-rc5 with commit b0b3dc66529676228cb938cbcad66920f735c223 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-98647 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: kernel/bpf/btf.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/1ea3820937f8022e044c41c6e95c84b02741b45f https://git.kernel.org/stable/c/172756f02663ad45c889c001c1a8cb4082a01a05 https://git.kernel.org/stable/c/934e9ba9f8d05656a48624710be67ca4dc8482e6 https://git.kernel.org/stable/c/63af086cb5fa6f72fd924f86bea4c2194da663a2 https://git.kernel.org/stable/c/8eb4cd72daad3a9ee63d2281bbdd16ce6d9406b1 https://git.kernel.org/stable/c/b8fa56722e9c43bcd59c51fe4c7edd5f4158a11b https://git.kernel.org/stable/c/b0b3dc66529676228cb938cbcad66920f735c223