CVE-2026-98589 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject pkt arguments in mutating subprogs
The verifier tracks changes in how PTR_TO_PACKET registers' bounds are modified across subprog boundaries. PTR_TO_PACKET registers are actually passed as PTR_TO_MEM, which is assumed valid for the entire call. This is not the case with packet memory, where a pskb_* call may invalidate its memory region.
Reject BPF code that passes PTR_TO_PACKET pointers to subprogs that may mutate a packet. We cannot pass the pointer as a true PTR_TO_PACKET because we would also need to somehow pass the PTR_TO_PACKET_META or PTR_TO_PACKET_END to the subprog. Since we cannot avoid representing the pointer in the subprog as PTR_TO_MEM, only permit it if the subprog is guaranteed not to mutate the packet.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The Linux kernel's eBPF subsystem relies on a sophisticated verifier to ensure that user-space programs are safe for execution within the kernel space. A critical aspect of this verification process involves tracking memory access bounds, particularly for packet data accessed via PTR_TO_PACKET registers. These registers represent pointers into network packet buffers and come with associated metadata such as meta pointers (PTR_TO_PACKET_META) and end pointers (PTR_TO_PACKET_END). The verifier must ensure that any access to these regions remains within the valid boundaries of the allocated buffer to prevent out-of-bounds reads or writes, which could lead to data corruption or privilege escalation.
A specific vulnerability was identified in how the verifier handles PTR_TO_PACKET registers when they are passed as arguments to subprograms, also known as helper functions called from BPF programs. Although these pointers are technically represented internally as PTR_TO_MEM within the context of a subprogram due to architectural constraints, the verifier previously failed to adequately account for the fact that packet memory regions can be invalidated during execution. Specifically, certain kernel helpers prefixed with pskb_*, which manipulate socket buffers, may reallocate or free the underlying packet data. If such operations occur while a pointer to that data is held by a subprogram, the original bounds tracked by the verifier become stale and invalid.
The core technical flaw lies in the assumption that PTR_TO_MEM pointers passed into subprograms remain valid for the entire duration of the call without considering potential mutations to the underlying packet structure. When a BPF program passes a pointer derived from a packet buffer to a mutating subprogram, there is no mechanism within the current verifier design to propagate updated meta or end pointers back to the caller if the memory region changes. This disconnect creates a scenario where the verifier might incorrectly assume that accesses made through the PTR_TO_MEM reference are still safe relative to the original bounds, even though those bounds may have shifted or become invalid due to pskb_ calls within the subprogram.
This vulnerability allows for potential out-of-bounds access if an attacker can craft BPF code that exploits this gap in bound tracking across subprogram boundaries. By passing packet pointers into mutating functions, malicious actors could potentially read sensitive kernel memory beyond the intended packet limits or write to arbitrary locations if further exploitation chains are present. The impact is significant as it undermines the fundamental safety guarantees provided by eBPF, potentially leading to information disclosure or system instability depending on how the invalid access is utilized in conjunction with other vulnerabilities.
To mitigate this risk, the fix implements a strict policy that rejects any BPF code attempting to pass PTR_TO_PACKET pointers into subprograms capable of mutating packet data. Since it is not feasible to pass the full set of packet metadata (meta and end pointers) through standard argument passing mechanisms without significant architectural changes, the verifier now ensures safety by disallowing such interactions entirely unless the subprogram can be proven to never mutate the packet. This approach effectively closes the window for out-of-bounds accesses arising from stale bounds tracking in mutating contexts.
From a classification perspective, this issue aligns with CWE-125, Out-of-Bounds Read, and potentially CWE-787, Out-of-Bounds Write, depending on whether the invalid access results in data leakage or memory corruption. In terms of attack vectors, it relates to ATT&CK technique T1068, Exploitation for Privilege Escalation, as bypassing eBPF sandbox restrictions is a common path for gaining higher privileges within the kernel. Security practitioners should ensure that their systems are updated with patches addressing this verifier logic error and monitor for any anomalous BPF program loading activities that might attempt to exploit similar boundary conditions in older or unpatched kernels.