CVE-2026-98626 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf: Restrict CO-RE poisoning to relocatable instructions
CO-RE relocation records can name any instruction offset. When a relocation cannot be resolved, bpf_core_patch_insn() currently poisons its target before checking whether that instruction is a valid relocation target. Malformed metadata can therefore replace jumps, calls, exits, register-source arithmetic, or non-immediate loads instead of failing at the relocation step.
Handle poisoning only after the instruction has passed the same class and operand-form checks used for a resolved relocation. Route invalid forms through the existing diagnostic and return a hard error. Keep poisoning supported instructions, including both halves of a plain ldimm64, so an unresolved relocation in dead code remains valid.
Extend bpf_core_poison_insn() to poison both halves of ldimm64, and return its status directly from each validated instruction case. This avoids routing the success path through a common label and leaves the helper free to report errors.
The shared relocation code applies this restriction to both libbpf and in-kernel CO-RE.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The Linux kernel's Berkeley Packet Filter subsystem contains a critical logic flaw within its Common Object File Format Relocation, or CO-RE, implementation that allows malformed metadata to bypass validation checks during the patching phase. The vulnerability stems from an incorrect ordering of operations in the bpf_core_patch_insn function, where poisoning is applied to target instructions before verifying whether those targets are valid relocation destinations. This architectural oversight means that if a relocation record references an instruction offset that cannot be resolved or points to an invalid instruction type, the system proceeds to corrupt the targeted code rather than rejecting the malformed input at the earlier validation stage.
This flaw enables attackers with access to BPF program metadata to inject malicious payloads by exploiting the poisoning mechanism as a vector for arbitrary memory corruption. Specifically, when CO-RE relocation records name any instruction offset without sufficient pre-validation, the system may poison jumps, calls, exits, register-source arithmetic operations, or non-immediate loads instead of failing gracefully during the relocation resolution step. By manipulating these metadata structures, an attacker can effectively replace legitimate control flow instructions with poisoned variants, potentially leading to code execution vulnerabilities within the kernel space where BPF programs operate under elevated privileges.
The operational impact of this vulnerability is significant because it undermines the integrity checks designed to protect the eBPF virtual machine from unsafe modifications. The poisoning mechanism was originally intended to prevent the use of unresolved relocations in dead code paths, ensuring that such instructions do not execute and cause undefined behavior. However, by applying poison before validation, the system inadvertently allows invalid instruction forms to be corrupted rather than rejected. This creates a scenario where malformed metadata can successfully alter critical program logic, potentially leading to denial of service or privilege escalation depending on how the poisoned instructions are subsequently executed during runtime evaluation.
The resolution involves restructuring the bpf_core_patch_insn function to enforce strict validation before any poisoning occurs. The fix ensures that an instruction must pass the same class and operand-form checks used for resolved relocations before it is considered a valid target for CO-RE patching. Invalid forms are now routed through existing diagnostic routines which return hard errors, preventing further processing of malformed data. Additionally, the bpf_core_poison_insn helper has been extended to correctly handle both halves of ldimm64 instructions, and its status is returned directly from each validated instruction case. This change avoids routing success paths through common labels and allows the helper function to report errors accurately without side effects on valid code segments.
From a standards perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the system failed to adequately validate metadata before processing it for patching operations. It also relates to CWE-476 NULL Pointer Dereference or similar memory safety issues if the poisoning leads to invalid state transitions in kernel memory management. In terms of ATT&CK mapping, this flaw could be leveraged within the T1059 Command and Scripting Interpreter technique by manipulating BPF programs that are often used for system monitoring and security enforcement, potentially allowing an attacker to subvert these controls if they have write access to relevant eBPF metadata files.
Mitigation strategies require applying the kernel patch that enforces pre-validation of relocation targets before poisoning is applied. System administrators should ensure their Linux kernels are updated with this specific fix to prevent exploitation via malformed CO-RE relocation records. For environments where BPF programs are dynamically loaded, strict access controls on metadata sources and runtime monitoring for unusual eBPF program modifications can provide additional layers of defense against attempts to exploit this logic error in the kernel's packet filter subsystem.