HIGH
bpf Backtrack Bypass
CVE-2026-98085
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPF_LD | BPF_{IND,ABS} instructions. These instructions are modelled as two branches: - fallthrough; - implicit exit from current subprogram. The implicit exit case was not handled by the backtrack_insn() function. When backtracking such a path backtrack_insn() did not call bt_subprog_enter(), which meant that backtracking continued manipulating precision marks in a caller frame, while looking at instructions in a callee frame. This lead to segmentation faults during verification (see the selftest), or unsound state pruning.
02KernelScan AI Analysis
Risk summary
A flaw in the BPF verifier's precision backtracking for legacy packet-load instructions (ld_abs/ld_ind) in subprograms causes incorrect frame handling, leading to verifier crashes or unsound state pruning. An attacker who can load BPF programs can exploit the unsound pruning to bypass verifier safety checks, gaining arbitrary kernel read/write and potential privilege escalation. Any system allowing BPF program loading is at risk.
Vulnerability analysis
The BPF verifier's precision backtracking mechanism fails to account for the implicit subprogram-exit branch that legacy ld_abs/ld_ind instructions model. When backtracking that exit path, the verifier continues modifying precision marks in a caller's frame while reading instructions from a callee's frame, creating a frame mismatch that can crash the verifier or produce unsound state pruning — meaning programs that should be rejected are accepted, bypassing the verifier's safety guarantees. The fix detects when backtracking the implicit-exit branch and switches to the correct caller frame before continuing. The vulnerability is reachable by any local user who can load BPF programs, which requires CAP_BPF (or unprivileged BPF if enabled on the system).
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 5.10.265 | 5.11 | 671b7b9a660e |
| 5.15 | 5.15.216 | 5.16 | 387b1baefbb7 |
| 6.1 | 6.1.183 | 6.2 | — |
| 6.6 | 6.6.148 | 6.7 | — |
| 6.12 | 6.12.101 | 6.13 | — |
| 6.18 | 6.18.42 | 6.19 | — |
| 7.0 | 7.0.10 | 7.1 | — |
| 7.2 | — | 7.2.7 | — |
| mainline | — | 7.3-rc2 | — |