AZL-104613
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-104613.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-104613
- Upstream
- Published
- 2026-09-25T11:17:38Z
- Modified
- 2026-09-27T05:34:32Z
- Summary
- CVE-2026-98085 affecting package kernel 6.6.157.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge
Nicholas Carlini reported a bug in precision backtracking mechanism for BPF_LD | BPF_{IND,ABS} instructions. These instructions are modelled as two branches:
- fallthrough;
- implicit exit from current subprogram.
The implicit exit case was not handled by the backtrack_insn() function. When backtracking such a path backtrack_insn() did not call bt_subprog_enter(), which meant that backtracking continued manipulating precision marks in a caller frame, while looking at instructions in a callee frame.
This lead to segmentation faults during verification (see the selftest), or unsound state pruning.
- References