Riskcovery

CVE-2026-98048

bpf: don't rewrite bpf_fastcall patterns entered by a jump

State
Published
Severity
Not scored
Published
Sep 25, 2026
Updated
Oct 21, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: don't rewrite bpf_fastcall patterns entered by a jump

mark_fastcall_pattern_for_call() must ensure that matched "spill; call; fill" instruction series is not interrupted by a jump. Otherwise the rewrite applied by bpf_remove_fastcall_spills_fills() is not sound.

Record the instructions targeted by jumps in insn_aux_data[*].jump_target when the CFG is built and use this flag to stop growing a pattern at such an instruction. Jumps to the first spill are fine.

Note that existing insn_aux_data[*].jmp_point field can't be reused, as it marks subprogram return instructions.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 5b5f51bff1b66cedb62b5ba74a1878341204e057 to before a0cd1c3ac63504ba3c50c01a00c11812919b619fAffected
  • 5b5f51bff1b66cedb62b5ba74a1878341204e057 to before c4d3bdb3ab211dcfad734b02e06fcb12adb4757fAffected
  • 5b5f51bff1b66cedb62b5ba74a1878341204e057 to before 24adbc2c3bbe3385ce922587e1f8e837a68b3e25Affected
  • 5b5f51bff1b66cedb62b5ba74a1878341204e057 to before 0b1c83dc3c4401cd7e846548f62e3caf3d06742eAffected
LinuxLinux
  • 6.12Affected
  • before 6.12Not affected
  • 6.12.114 through 6.12.*Not affected
  • 6.18.57 through 6.18.*Not affected
  • 7.2.7 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.