CVE-2026-98085

bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge

State: Published
Severity: Not scored
Published: Sep 25, 2026
Updated: Oct 21, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge

Nicholas Carlini reported a bug in precision backtracking mechanism for BPF_LD | BPF_{IND,ABS} instructions. These instructions are modelled as two branches: - fallthrough; - implicit exit from current subprogram.

The implicit exit case was not handled by the backtrack_insn() function. When backtracking such a path backtrack_insn() did not call bt_subprog_enter(), which meant that backtracking continued manipulating precision marks in a caller frame, while looking at instructions in a callee frame.

This lead to segmentation faults during verification (see the selftest), or unsound state pruning.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	37ad2bb11e9de92cb7b94548705eeedd87f7d392 to before 19cca7c36055906b3cff3e297618ee8a50cde25dAffected 8674e2db06cff6b50f2216eed9a761d15425bb34 to before 12c064bcfa56e3631be9f5336ee113b7f849959aAffected ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337 to before a0cd9e22f8faed30a8da8be357c51bd8b3074ee9Affected ee861486e377edc55361c08dcbceab3f6b6577bd to before 671b7b9a660ef15b25faa3df161205b9dc8d1eb2Affected ee861486e377edc55361c08dcbceab3f6b6577bd to before 387b1baefbb776e3f48dc2261e77a49213f470f7Affected 928d354ae3557e8f755a227e67be88034eb3cd7fAffected 8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbeAffected de1055e7f9e67af32b1f3376066272b04e5223c0Affected d846d83bdacbd8f14fc45c63b8c1d22608452e1cAffected 6.6.148 to before 6.6.160Affected 6.12.101 to before 6.12.114Affected 6.18.42 to before 6.18.57Affected 5.10.265 to before 5.11Affected 5.15.216 to before 5.16Affected 6.1.183 to before 6.2Affected 7.0.10 to before 7.1Affected
LinuxLinux	7.1Affected before 7.1Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.57 through 6.18.Not affected 7.2.7 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

37ad2bb11e9de92cb7b94548705eeedd87f7d392 to before 19cca7c36055906b3cff3e297618ee8a50cde25dAffected
8674e2db06cff6b50f2216eed9a761d15425bb34 to before 12c064bcfa56e3631be9f5336ee113b7f849959aAffected
ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337 to before a0cd9e22f8faed30a8da8be357c51bd8b3074ee9Affected
ee861486e377edc55361c08dcbceab3f6b6577bd to before 671b7b9a660ef15b25faa3df161205b9dc8d1eb2Affected
ee861486e377edc55361c08dcbceab3f6b6577bd to before 387b1baefbb776e3f48dc2261e77a49213f470f7Affected
928d354ae3557e8f755a227e67be88034eb3cd7fAffected
8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbeAffected
de1055e7f9e67af32b1f3376066272b04e5223c0Affected
d846d83bdacbd8f14fc45c63b8c1d22608452e1cAffected
6.6.148 to before 6.6.160Affected
6.12.101 to before 6.12.114Affected
6.18.42 to before 6.18.57Affected
5.10.265 to before 5.11Affected
5.15.216 to before 5.16Affected
6.1.183 to before 6.2Affected
7.0.10 to before 7.1Affected

LinuxLinux

7.1Affected
before 7.1Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.57 through 6.18.*Not affected
7.2.7 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.