Strix
75.2K

CVE-2026-98085

UnknownEPSS 0.17%

Last modified

CVE-2026-98085 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPF_LD | BPF_{IND,ABS} instructions. These instructions are modelled as two branches: - fallthrough; - implicit exit from current subprogram. The implicit exit case was not handled by the backtrack_insn() function. EPSS estimates a 0.17% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPF_LD | BPF_{IND,ABS} instructions. These instructions are modelled as two branches: - fallthrough; - implicit exit from current subprogram. The implicit exit case was not handled by the backtrack_insn() function. When backtracking such a path backtrack_insn() did not call bt_subprog_enter(), which meant that backtracking continued manipulating precision marks in a caller frame, while looking at instructions in a callee frame. This lead to segmentation faults during verification (see the selftest), or unsound state pruning.

Metrics

EPSS Probability
0.17%

5.5th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 37ad2bb11e9de92cb7b94548705eeedd87f7d392, < 19cca7c36055906b3cff3e297618ee8a50cde25d; >= 8674e2db06cff6b50f2216eed9a761d15425bb34, < 12c064bcfa56e3631be9f5336ee113b7f849959a; >= ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337, < a0cd9e22f8faed30a8da8be357c51bd8b3074ee9; >= ee861486e377edc55361c08dcbceab3f6b6577bd, < 671b7b9a660ef15b25faa3df161205b9dc8d1eb2; >= ee861486e377edc55361c08dcbceab3f6b6577bd, < 387b1baefbb776e3f48dc2261e77a49213f470f7; 928d354ae3557e8f755a227e67be88034eb3cd7f; 8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbe; de1055e7f9e67af32b1f3376066272b04e5223c0; d846d83bdacbd8f14fc45c63b8c1d22608452e1c; >= 6.6.148, < 6.6.160; >= 6.12.101, < 6.12.114; >= 6.18.42, < 6.18.57; >= 5.10.265, < 5.11; >= 5.15.216, < 5.16; >= 6.1.183, < 6.2; >= 7.0.10, < 7.1
LinuxLinux7.1

References

Timeline

Published
Last Modified
Status
Undergoing Analysis

Frequently Asked Questions

What is CVE-2026-98085?
In the Linux kernel, the following vulnerability has been resolved: bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPF_LD | BPF_{IND,ABS} instructions. These instructions are modelled as two branches: - fallthrough; - implicit exit from current subprogram. The implicit exit case was not handled by the backtrack_insn() function. When backtracking such a path backtrack_insn() did not call bt_subprog_enter(), which meant that backtracking continued manipulating precision marks in a caller frame, while looking at instructions in a callee frame. This lead to segmentation faults during verification (see the selftest), or unsound state pruning.
How severe is CVE-2026-98085?
Severity scoring for CVE-2026-98085 is pending analysis. The EPSS model estimates a 0.17% probability of exploitation in the next 30 days.
How do I fix CVE-2026-98085?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-98085?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST