CVE-2026-98085: bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-25 · updated 2026-10-21

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPF_LD | BPF_{IND,ABS} instructions. These instructions are modelled as two branches: - fallthrough; - implicit exit from current subprogram. The implicit exit case was not handled by the backtrack_insn() function. When backtracking such a path backtrack_insn() did not call bt_subprog_enter(), which meant that backtracking continued manipulating precision marks in a caller frame, while looking at instructions in a callee frame. This lead to segmentation faults during verification (see the selftest), or unsound state pruning.

Affected products

Linux kernel: from 6.6.148 before 6.6.160; from 6.12.101 before 6.12.114; from 6.18.42 before 6.18.57; from 5.10.265 before 5.11; from 5.15.216 before 5.16; from 6.1.183 before 6.2 — fixed in 5.11, 5.16, 6.12.114, 6.18.57, 6.2, 6.6.160

How to fix

Upgrade to a fixed version: Linux kernel 5.11, 5.16, 6.12.114, 6.18.57. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-98085 or the next vulnerability affects your stack