HIGH
bpf Callback Precision Bypass
CVE-2026-98084
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks When processing calls to bpf_loop() verifier marks R1 (and R4) as precise. R1 tracks loop iterations number and because of the 'callback_depth < R1' mechanics in check_helper_call() must be marked precise. However, precision propagation for R1 was broken, when bpf_loop() call was verified on a second iteration. Consider the following verification trace: - main: bpf_loop(nr_loops, callback ...) - callback: BPF_EXIT - main: bpf_loop(nr_loops, callback ...) - ... While the first visit of the call to bpf_loop() propagated R1 precision as expected, the second call to mark_chain_precision() in the check_helper_call() set R1, but it was immediately reset when backtrack_insn() processed preceding BPF_EXIT in the loop deleted in this patch. Because of that, the second visit of the call to bpf_loop() injected checkpoint with R1 not marked as precise. Which could trick the verifier into accepting unsafe programs. See the next patch for an example of such program. Commit is structured in a way to minimize conflicts when 'bpf' would be eventually merged with 'bpf-next'.
02KernelScan AI Analysis
Risk summary
A flaw in the BPF verifier's precision backtracking logic allows crafted BPF programs using callbacks (e.g., bpf_loop) to bypass verification on a second iteration, potentially enabling arbitrary kernel memory read/write. Any local user who can load BPF programs (requires CAP_BPF) could exploit this to escalate privileges or crash the kernel.
Vulnerability analysis
The BPF verifier loses track of safety information when it re-examines a callback-based loop during verification. On a later pass through the loop, it incorrectly discarded tracking data for the caller's arguments, causing the loop iteration count to be treated as unknown. This allowed unsafe programs to pass verification when they should have been rejected. The fix preserves argument tracking across callback returns, ensuring the verifier maintains correct knowledge of loop bounds on every pass. Any local user or service that can load BPF programs can trigger this flaw.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | — | 6.12.114 | cdc93c6370f7 |
| 6.18 | — | 6.18.57 | 3a39bc9707fb |
| 6.6 | 6.6.15 | 6.6.160 | 1ac58dab0a83 |
| 7.2 | — | 7.2.7 | f83890dfed9e |
| mainline | — | 7.3 | e3e4f66cc4b7 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Affected — no CIP fix yet (latest 6.12.112-cip33) |