Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-98085

bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPF_LD | BPF_{IND,ABS} instructions. These instructions are modelled as two branches: - fallthrough; - implicit exit from current subprogram. The implicit exit case was not handled by the backtrack_insn() function. When backtracking such a path backtrack_insn() did not call bt_subprog_enter(), which meant that backtracking continued manipulating precision marks in a caller frame, while looking at instructions in a callee frame. This lead to segmentation faults during verification (see the selftest), or unsound state pruning.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 37ad2bb11e9de92cb7b94548705eeedd87f7d392 to < 19cca7c36055906b3cff3e297618ee8a50cde25daffected
  • 8674e2db06cff6b50f2216eed9a761d15425bb34 to < 12c064bcfa56e3631be9f5336ee113b7f849959aaffected
  • ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337 to < a0cd9e22f8faed30a8da8be357c51bd8b3074ee9affected
  • ee861486e377edc55361c08dcbceab3f6b6577bd to < 671b7b9a660ef15b25faa3df161205b9dc8d1eb2affected
  • ee861486e377edc55361c08dcbceab3f6b6577bd to < 387b1baefbb776e3f48dc2261e77a49213f470f7affected
  • 928d354ae3557e8f755a227e67be88034eb3cd7faffected
  • 8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbeaffected
  • de1055e7f9e67af32b1f3376066272b04e5223c0affected
  • d846d83bdacbd8f14fc45c63b8c1d22608452e1caffected
  • 6.6.148 to < 6.6.160affected
  • 6.12.101 to < 6.12.114affected
  • 6.18.42 to < 6.18.57affected
  • 5.10.265 to < 5.11affected
  • 5.15.216 to < 5.16affected
  • 6.1.183 to < 6.2affected
  • 7.0.10 to < 7.1affected

Linux Linux

Default version status: affected

  • 7.1affected
  • 0 to < 7.1unaffected
  • 6.6.160 to ≤ 6.6.*unaffected
  • 6.12.114 to ≤ 6.12.*unaffected
  • 6.18.57 to ≤ 6.18.*unaffected
  • 7.2.7 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References