Linux Kernel up to 7.2.6/7.3-rc1 BPF mark_fastcall_pattern_for_call behavioral workflow

Summaryinfo

A vulnerability was found in Linux Kernel up to 7.2.6/7.3-rc1. It has been classified as critical. Impacted is the function mark_fastcall_pattern_for_call of the component BPF. The manipulation leads to behavioral workflow. This vulnerability is documented as CVE-2026-98048. The attack needs to be performed locally. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.2.6/7.3-rc1 and classified as critical. This issue affects the function mark_fastcall_pattern_for_call of the component BPF. The manipulation with an unknown input leads to a behavioral workflow vulnerability. Using CWE to declare the problem leads to CWE-841. The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: bpf: don't rewrite bpf_fastcall patterns entered by a jump mark_fastcall_pattern_for_call() must ensure that matched "spill; call; fill" instruction series is not interrupted by a jump. Otherwise the rewrite applied by bpf_remove_fastcall_spills_fills() is not sound. Record the instructions targeted by jumps in insn_aux_data[*].jump_target when the CFG is built and use this flag to stop growing a pattern at such an instruction. Jumps to the first spill are fine. Note that existing insn_aux_data[*].jmp_point field can't be reused, as it marks subprogram return instructions.

The advisory is shared at git.kernel.org. The identification of this vulnerability is CVE-2026-98048 since 09/25/2026. The exploitation is known to be easy. An attack has to be approached locally. The exploitation needs additional levels of successful authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/25/2026).

Upgrading to version 7.2.7 or 7.3-rc2 eliminates this vulnerability. Applying the patch 24adbc2c3bbe3385ce922587e1f8e837a68b3e25/0b1c83dc3c4401cd7e846548f62e3caf3d06742e is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5
• 7.2.6
• 7.3-rc1

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion