HIGH Introduced in 6.4
bpf StackSlot Offset Bypass
CVE-2026-98599
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-negative offsets in stack_slot_obj_get_spi() bpf_get_spi() computes (-off - 1) / BPF_REG_SIZE using C division, which truncates toward zero. For off == 0, this produces spi 0, the same index used by the valid stack slot at fp-8. stack_slot_obj_get_spi() currently checks alignment and the resulting spi bounds, but does not reject the non-negative offset itself. It can therefore validate a PTR_TO_STACK register holding fp+0 against an iterator stored at fp-8 even though the runtime receives the actual fp+0 pointer. An effectful iterator kfunc can then interpret memory outside the BPF stack as iterator state. Reject non-negative offsets before converting the offset to an spi. All valid stack objects begin at a negative offset from the frame pointer.
02KernelScan AI Analysis
Risk summary
A local user who can load BPF programs can exploit a verifier validation gap to pass a pointer to the frame pointer (fp+0) where a stack iterator at fp-8 is expected. This causes iterator kfuncs to read and write kernel stack memory outside the BPF stack, enabling arbitrary kernel memory read/write and privilege escalation. Systems with unprivileged BPF enabled are exposed to any local user; otherwise the attack requires CAP_BPF (typically root or a privileged container).
Vulnerability analysis
The BPF verifier's stack_slot_obj_get_spi() function incorrectly accepts non-negative stack offsets when validating pointers to iterator objects. Because the helper bpf_get_spi() computes a stack index using C division that truncates toward zero, an offset of zero produces the same index as the legitimate iterator slot at fp-8. The verifier therefore treats a PTR_TO_STACK register pointing at the frame pointer itself as a valid iterator reference. At runtime, the iterator kfunc receives the actual fp+0 pointer and operates on memory outside the BPF stack frame, interpreting adjacent kernel stack data as iterator state. The fix adds an explicit check to reject any offset >= 0 before the index calculation, since all valid stack objects must reside at negative offsets from the frame pointer. The vulnerability is reachable by any local user able to load a BPF program (CAP_BPF); on distributions with unprivileged_bpf_disabled=0 this includes unprivileged users, while on most production systems it requires root or a privileged container.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 6.4 | 7.2.9 | 89a7241fc7ec |
| mainline | 6.4 | 7.3 | 79a9172f3ab4 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Affected — no CIP fix yet (latest 6.12.112-cip33) |