Strix
64.9K

CVE-2026-98007

Unknown

Last modified

CVE-2026-98007 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-scalar bpf_loop iteration counts bpf_loop() declares its nr_loops argument as ARG_ANYTHING. Privileged programs may pass pointer values to such arguments, so check_func_arg() lets a pointer-valued R1 reach the helper-specific checks. Since commit bb124da69c47 ("bpf: keep track of max number of bpf_loop callback iterations"), the verifier marks R1 precise and reads its upper bound to limit callback simulation.

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-scalar bpf_loop iteration counts bpf_loop() declares its nr_loops argument as ARG_ANYTHING. Privileged programs may pass pointer values to such arguments, so check_func_arg() lets a pointer-valued R1 reach the helper-specific checks. Since commit bb124da69c47 ("bpf: keep track of max number of bpf_loop callback iterations"), the verifier marks R1 precise and reads its upper bound to limit callback simulation. Precision backtracking only accepts scalar registers, so passing a pointer instead triggers the "backtracking misuse" verifier warning. Kernels with panic_on_warn enabled subsequently panic. Introduce ARG_SCALAR for helper arguments that only accept scalar values and use it for bpf_loop() nr_loops. Generic helper argument validation then rejects pointers before loop inlining and precision processing.

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= bb124da69c47dd98d69361ec13244ece50bec63e, < 656d40d1ca228ee21a9b3280432479fc9eae75ab; >= bb124da69c47dd98d69361ec13244ece50bec63e, < e2e1161e03fecff6d2229a81b024337144bfcd97; >= bb124da69c47dd98d69361ec13244ece50bec63e, < f8ae8275c721334ee50fafdd986fb83294eb941a; >= bb124da69c47dd98d69361ec13244ece50bec63e, < c3fd8e5fd100f122bad503bdc0e9277219533253; bfc5c19b4b48840627af0d0f1c8f4461b276e508; >= 6.6.15, < 6.7
LinuxLinux6.7

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-98007?
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-scalar bpf_loop iteration counts bpf_loop() declares its nr_loops argument as ARG_ANYTHING. Privileged programs may pass pointer values to such arguments, so check_func_arg() lets a pointer-valued R1 reach the helper-specific checks. Since commit bb124da69c47 ("bpf: keep track of max number of bpf_loop callback iterations"), the verifier marks R1 precise and reads its upper bound to limit callback simulation. Precision backtracking only accepts scalar registers, so passing a pointer instead triggers the "backtracking misuse" verifier warning. Kernels with panic_on_warn enabled subsequently panic. Introduce ARG_SCALAR for helper arguments that only accept scalar values and use it for bpf_loop() nr_loops. Generic helper argument validation then rejects pointers before loop inlining and precision processing.
How severe is CVE-2026-98007?
Severity scoring for CVE-2026-98007 is pending analysis.
How do I fix CVE-2026-98007?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-98007?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST