Linux Kernel up to 7.2.8/7.3-rc4 BPF memory corruption

Summaryinfo

A vulnerability labeled as very critical has been found in Linux Kernel up to 7.2.8/7.3-rc4. This issue affects some unknown processing of the component BPF. Such manipulation leads to memory corruption. This vulnerability is documented as CVE-2026-98589. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.2.8/7.3-rc4 and classified as very critical. Affected by this issue is an unknown part of the component BPF. The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject pkt arguments in mutating subprogs The verifier tracks changes in how PTR_TO_PACKET registers' bounds are modified across subprog boundaries. PTR_TO_PACKET registers are actually passed as PTR_TO_MEM, which is assumed valid for the entire call. This is not the case with packet memory, where a pskb_* call may invalidate its memory region. Reject BPF code that passes PTR_TO_PACKET pointers to subprogs that may mutate a packet. We cannot pass the pointer as a true PTR_TO_PACKET because we would also need to somehow pass the PTR_TO_PACKET_META or PTR_TO_PACKET_END to the subprog. Since we cannot avoid representing the pointer in the subprog as PTR_TO_MEM, only permit it if the subprog is guaranteed not to mutate the packet.

The advisory is shared for download at git.kernel.org. This vulnerability is handled as CVE-2026-98589 since 09/25/2026. The exploitation is known to be easy. The attack may be launched remotely. The exploitation needs additional levels of successful authentication. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 10/18/2026).

Upgrading to version 7.2.9 or 7.3-rc5 eliminates this vulnerability. Applying the patch 0b6b2bb9b90ad1e2d94d18f626258a1dbbdee0ea/a6c1edfbe240e4377038a0e1d233ad81fde9a21b is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5
• 7.2.6
• 7.2.7
• 7.2.8
• 7.3-rc1
• 7.3-rc2
• 7.3-rc3
• 7.3-rc4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion