CVE-2026-98075
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf: reject BPF_PSEUDO_FUNC reference to the main program
fixups.c:jit_subprogs() rewrites BPF_PSEUDO_FUNC loads to contain real function addresses. This function is invoked from bpf_jit_subprogs() only when env->subprog_cnt > 1. Meaning that for any program like below:
int main(void *ctx) {
void *ptr = main; ... bpf_timer_set_callback(..., ptr); ... }
The 'ptr' won't be ever converted to contain an address. In combination with e.g. bpf_timer_set_callback() this would lead to a function call at a bogus address.
Instead of complicating the implementation, just assume that no useful program needs main to be a sync or async callback and reject BPF_PSEUDO_FUNC loads for the main subprogram.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The Linux kernel has addressed a critical security flaw within its Berkeley Packet Filter (BPF) subsystem related to how function pointers are resolved during Just-In-Time compilation. The vulnerability centers on the handling of BPF_PSEUDO_FUNC references, which allow eBPF programs to call other functions or subprograms. Specifically, the issue arises in the jit_subprogs() function within fixups.c, which is responsible for rewriting these pseudo-function loads into actual memory addresses during the JIT compilation process. This rewriting mechanism is designed to ensure that indirect calls resolve correctly by replacing symbolic references with concrete runtime addresses. However, a logical gap exists when dealing with the main program of an eBPF application rather than its subprograms.
The core technical flaw occurs because jit_subprogs() is only invoked from bpf_jit_subprogs() under the condition that the number of subprograms exceeds one. Consequently, if an eBPF program attempts to take a reference to its own main function and store it in a variable for later use, such as passing it to helper functions like bpf_timer_set_callback(), this reference remains unconverted. The BPF_PSEUDO_FUNC load instruction targeting the main subprogram is not processed by the fixup logic because the condition env->subprog_cnt > 1 evaluates to false when there are no additional subprograms beyond the main one. As a result, the pointer variable retains its original symbolic or uninitialized state rather than being populated with a valid memory address.
This oversight leads to severe operational impacts, primarily in the form of undefined behavior and potential system instability. When an eBPF program attempts to invoke a callback using this unconverted pointer, it results in a function call at a bogus or invalid memory address. In the context of kernel-space execution, such as that performed by BPF programs, calling through an invalid pointer can lead to immediate crashes, kernel panics, or potentially exploitable conditions if the garbage value happens to point to accessible but unintended code paths. This represents a significant risk to system availability and integrity, particularly in environments where eBPF is used for critical networking, observability, or security monitoring tasks that rely on timers and asynchronous callbacks.
To mitigate this vulnerability, the Linux kernel developers have implemented a preventive measure rather than attempting to complicate the existing JIT logic to handle main program references correctly. The fix explicitly rejects BPF_PSEUDO_FUNC loads when they target the main subprogram of an eBPF application. This decision is based on the architectural assumption that no legitimate or useful eBPF program requires its own main function to be passed as a synchronous or asynchronous callback argument. By rejecting such constructs at validation time, the kernel prevents the creation of programs with invalid pointers before they reach the JIT compiler stage.
From a vulnerability classification perspective, this issue aligns with CWE-476, which denotes NULL Pointer Dereference, although in this specific case it may involve dereferencing an uninitialized or garbage pointer rather than strictly null memory. It also relates to CWE-823, Use of Out-of-range Pointer Offset, as the resulting address is effectively out of bounds for valid code execution. In terms of the MITRE ATT&CK framework, this vulnerability could be leveraged in techniques associated with Defense Evasion or Impact categories if an attacker can craft a malicious eBPF program to trigger a kernel crash (Denial of Service) or potentially exploit memory corruption issues arising from invalid pointer dereferences during JIT compilation. The fix ensures that such malformed programs are rejected early, thereby closing the attack vector at the validation layer rather than allowing it to propagate into the execution environment.