Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-98007

bpf: Reject non-scalar bpf_loop iteration counts

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-scalar bpf_loop iteration counts bpf_loop() declares its nr_loops argument as ARG_ANYTHING. Privileged programs may pass pointer values to such arguments, so check_func_arg() lets a pointer-valued R1 reach the helper-specific checks. Since commit bb124da69c47 ("bpf: keep track of max number of bpf_loop callback iterations"), the verifier marks R1 precise and reads its upper bound to limit callback simulation. Precision backtracking only accepts scalar registers, so passing a pointer instead triggers the "backtracking misuse" verifier warning. Kernels with panic_on_warn enabled subsequently panic. Introduce ARG_SCALAR for helper arguments that only accept scalar values and use it for bpf_loop() nr_loops. Generic helper argument validation then rejects pointers before loop inlining and precision processing.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • bfc5c19b4b48840627af0d0f1c8f4461b276e508 to < 2ff38b3552af53238aee6c877ae64cc798d46fceaffected
  • bb124da69c47dd98d69361ec13244ece50bec63e to < 656d40d1ca228ee21a9b3280432479fc9eae75abaffected
  • bb124da69c47dd98d69361ec13244ece50bec63e to < e2e1161e03fecff6d2229a81b024337144bfcd97affected
  • bb124da69c47dd98d69361ec13244ece50bec63e to < f8ae8275c721334ee50fafdd986fb83294eb941aaffected
  • bb124da69c47dd98d69361ec13244ece50bec63e to < c3fd8e5fd100f122bad503bdc0e9277219533253affected
  • 6.6.15 to < 6.6.158affected

Linux Linux

Default version status: affected

  • 6.7affected
  • 0 to < 6.7unaffected
  • 6.6.158 to ≤ 6.6.*unaffected
  • 6.12.111 to ≤ 6.12.*unaffected
  • 6.18.53 to ≤ 6.18.*unaffected
  • 7.2.7 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References