CVE-2026-98007
- Source
- https://cve.org/CVERecord?id=CVE-2026-98007
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98007.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-98007
- Downstream
- Related
- Published
- 2026-09-25T10:23:32Z
- Modified
- 2026-10-09T17:26:57Z
- Summary
- bpf: Reject non-scalar bpf_loop iteration counts
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject non-scalar bpf_loop iteration counts
bpf_loop() declares its nr_loops argument as ARG_ANYTHING. Privileged programs may pass pointer values to such arguments, so check_func_arg() lets a pointer-valued R1 reach the helper-specific checks.
Since commit bb124da69c47 ("bpf: keep track of max number of bpf_loop callback iterations"), the verifier marks R1 precise and reads its upper bound to limit callback simulation. Precision backtracking only accepts scalar registers, so passing a pointer instead triggers the "backtracking misuse" verifier warning. Kernels with panic_on_warn enabled subsequently panic.
Introduce ARG_SCALAR for helper arguments that only accept scalar values and use it for bpf_loop() nr_loops. Generic helper argument validation then rejects pointers before loop inlining and precision processing.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98007.json" }- References
-
- https://git.kernel.org/stable/c/2ff38b3552af53238aee6c877ae64cc798d46fce
- https://git.kernel.org/stable/c/656d40d1ca228ee21a9b3280432479fc9eae75ab
- https://git.kernel.org/stable/c/c3fd8e5fd100f122bad503bdc0e9277219533253
- https://git.kernel.org/stable/c/e2e1161e03fecff6d2229a81b024337144bfcd97
- https://git.kernel.org/stable/c/f8ae8275c721334ee50fafdd986fb83294eb941a
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98007.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-98007
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedbfc5c19b4b48840627af0d0f1c8f4461b276e508Fixed2ff38b3552af53238aee6c877ae64cc798d46fce
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedbb124da69c47dd98d69361ec13244ece50bec63eFixed656d40d1ca228ee21a9b3280432479fc9eae75abFixede2e1161e03fecff6d2229a81b024337144bfcd97Fixedf8ae8275c721334ee50fafdd986fb83294eb941aFixedc3fd8e5fd100f122bad503bdc0e9277219533253
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.6.15Fixed6.6.158