CVE-2026-98044: bpf: Reject legacy packet loads from callbacks

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-25 · updated 2026-10-21

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject legacy packet loads from callbacks check_ld_abs() models a failed BPF_LD_ABS or BPF_LD_IND in a subprogram as an implicit return with R0 set to zero. It calls prepare_func_exit() to explore this synthesized path. When the load is reached directly from a synchronous callback, prepare_func_exit() enforces the callback return contract and marks R0 precise. R0 is not derived from a real instruction on this path, so precision backtracking reaches the callback call with R0 still requested and triggers the "callback unexpected regs" verifier bug. A privileged program loader can therefore cause a verifier warning and an -EFAULT BPF_PROG_LOAD. These legacy packet-load instructions are deprecated. Reject them from callbacks rather than complicating their implicit-return model. Check all active frames before constructing the implicit return so nested static subprograms cannot hide the callback context. Global functions are verified independently with a fresh frame zero, so an active-frame check cannot identify a global function called from a callback. Also check the complete subprogram call graph during stack-depth validation and reject a function containing a legacy load when any caller is a callback. This covers global and static descendants without making has_ld_abs transitive, preserving its per-function BTF return-type check. Ordinary uses outside callbacks remain supported.

Affected products

Linux kernel: from 6.12.101 before 6.12.114; from 6.18.42 before 6.18.53; from 5.10.265 before 5.11; from 5.15.216 before 5.16; from 6.1.183 before 6.2; from 6.6.148 before 6.7 — fixed in 5.11, 5.16, 6.12.114, 6.18.53, 6.2, 6.7

How to fix

Upgrade to a fixed version: Linux kernel 5.11, 5.16, 6.12.114, 6.18.53. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-98044 or the next vulnerability affects your stack