CVE-2026-98599 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject non-negative offsets in stack_slot_obj_get_spi()
bpf_get_spi() computes (-off - 1) / BPF_REG_SIZE using C division, which truncates toward zero. For off == 0, this produces spi 0, the same index used by the valid stack slot at fp-8.
stack_slot_obj_get_spi() currently checks alignment and the resulting spi bounds, but does not reject the non-negative offset itself. It can therefore validate a PTR_TO_STACK register holding fp+0 against an iterator stored at fp-8 even though the runtime receives the actual fp+0 pointer. An effectful iterator kfunc can then interpret memory outside the BPF stack as iterator state.
Reject non-negative offsets before converting the offset to an spi. All valid stack objects begin at a negative offset from the frame pointer.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel contains a critical logic flaw within the eBPF verifier subsystem, specifically in the function responsible for mapping BPF register offsets to stack slot indices. This vulnerability arises from incorrect arithmetic handling when calculating the Stack Pointer Index (SPI) for memory access validation. The core issue lies in how negative and non-negative offsets are processed during the conversion of a relative offset into an absolute index within the kernel's internal data structures used for tracking eBPF program state.
The specific technical flaw occurs in the stack_slot_obj_get_spi() function, which is tasked with validating whether a given pointer register points to a valid location on the BPF stack. The code computes the SPI using the formula (-off - 1) / BPF_REG_SIZE, relying on C integer division behavior that truncates toward zero. When the offset off is exactly zero, this calculation results in an SPI of 0. However, index 0 corresponds to a valid and reserved stack slot located at frame pointer minus eight bytes (fp-8). Consequently, a register holding a pointer with an offset of zero from the base frame pointer is incorrectly validated as pointing to fp-8 rather than being rejected or mapped correctly.
This misalignment creates a severe security boundary violation because it allows the verifier to accept PTR_TO_STACK registers that actually point outside the allocated BPF stack space. Specifically, a register holding the address fp+0 is treated by the verification logic as if it holds the address of the valid slot at fp-8. This discrepancy means that subsequent checks against iterator state stored in known safe locations may pass validation even though the actual memory access targets an unauthorized region. The verifier fails to reject non-negative offsets, which are inherently invalid for stack-relative addressing since all legitimate BPF stack objects reside at negative offsets from the frame pointer.
The operational impact of this vulnerability is significant when combined with effectful iterator kernel functions (kfuncs). An attacker or a malicious eBPF program can exploit this discrepancy by using an iterator kfunc that interprets memory outside the designated BPF stack as valid iterator state. By leveraging the incorrect SPI mapping, such programs could read from or write to arbitrary kernel memory locations adjacent to the stack, potentially leading to information disclosure, privilege escalation, or system instability. The vulnerability effectively bypasses the strict isolation guarantees provided by the eBPF sandboxing mechanism.
To mitigate this risk, it is imperative that the verifier logic be updated to explicitly reject non-negative offsets before they are converted into SPI values. Since all valid stack objects must begin at a negative offset relative to the frame pointer, any attempt to access memory with an offset of zero or greater should immediately fail verification. This change ensures that only pointers strictly within the lower bounds of the allocated stack space are considered valid for iterator operations and other sensitive kernel interactions.
From a classification perspective, this vulnerability aligns with CWE-20: Improper Input Validation, as the system fails to correctly validate input parameters regarding memory offsets against expected constraints. It also relates to CWE-682: Incorrect Calculation, due to the flawed arithmetic logic in offset-to-index conversion. In terms of attack vectors and techniques, this flaw facilitates unauthorized access to kernel resources, which can be categorized under ATT&CK technique T1059: Command and Scripting Interpreter if leveraged for further exploitation, or more broadly as a privilege escalation vector through improper sandbox escape mechanisms inherent to eBPF programs.