CVE-2026-98085
Last modified
CVE-2026-98085 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPF_LD | BPF_{IND,ABS} instructions. These instructions are modelled as two branches: - fallthrough; - implicit exit from current subprogram. The implicit exit case was not handled by the backtrack_insn() function.
Description
In the Linux kernel, the following vulnerability has been resolved: bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPF_LD | BPF_{IND,ABS} instructions. These instructions are modelled as two branches: - fallthrough; - implicit exit from current subprogram. The implicit exit case was not handled by the backtrack_insn() function. When backtracking such a path backtrack_insn() did not call bt_subprog_enter(), which meant that backtracking continued manipulating precision marks in a caller frame, while looking at instructions in a callee frame. This lead to segmentation faults during verification (see the selftest), or unsound state pruning.
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= ee861486e377edc55361c08dcbceab3f6b6577bd, < 671b7b9a660ef15b25faa3df161205b9dc8d1eb2; >= ee861486e377edc55361c08dcbceab3f6b6577bd, < 387b1baefbb776e3f48dc2261e77a49213f470f7; 928d354ae3557e8f755a227e67be88034eb3cd7f; 8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbe; de1055e7f9e67af32b1f3376066272b04e5223c0; 37ad2bb11e9de92cb7b94548705eeedd87f7d392; 8674e2db06cff6b50f2216eed9a761d15425bb34; ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337; d846d83bdacbd8f14fc45c63b8c1d22608452e1c; >= 5.10.265, < 5.11; >= 5.15.216, < 5.16; >= 6.1.183, < 6.2; >= 6.6.148, < 6.7; >= 6.12.101, < 6.13; >= 6.18.42, < 6.19; >= 7.0.10, < 7.1 |
| Linux | Linux | 7.1 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-98085?
How severe is CVE-2026-98085?
How do I fix CVE-2026-98085?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-9808An authorization bypass vulnerability exists in the Mautic 7…7.1
- CVE-2026-98080In the Linux kernel, the following vulnerability has been re…
- CVE-2026-98081In the Linux kernel, the following vulnerability has been re…
- CVE-2026-98082In the Linux kernel, the following vulnerability has been re…
- CVE-2026-98083In the Linux kernel, the following vulnerability has been re…7
- CVE-2026-98084In the Linux kernel, the following vulnerability has been re…
- CVE-2026-98086In the Linux kernel, the following vulnerability has been re…
- CVE-2026-98087In the Linux kernel, the following vulnerability has been re…
- CVE-2026-98088In the Linux kernel, the following vulnerability has been re…
- CVE-2026-98089In the Linux kernel, the following vulnerability has been re…
- CVE-2026-9809A stored Cross-Site Scripting (XSS) vulnerability exists in …7.6
- CVE-2026-98090In the Linux kernel, the following vulnerability has been re…
Are you affected by CVE-2026-98085?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST