Linux Kernel up to 7.2.8/7.3-rc4 BPF Verifier resource consumption

Summaryinfo

A vulnerability, which was classified as problematic, was found in Linux Kernel up to 7.2.8/7.3-rc4. This affects the function bpf_opt_remove_nops/bpf_patch_insn_data/verifier_remove_insns of the component BPF Verifier. Executing a manipulation can lead to resource consumption. This vulnerability is handled as CVE-2026-98628. It is possible to launch the attack on the local host. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.2.8/7.3-rc4. It has been declared as problematic. This vulnerability affects the function bpf_opt_remove_nops/bpf_patch_insn_data/verifier_remove_insns of the component BPF Verifier. The manipulation with an unknown input leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: bpf: Make post-verification instruction rewrites killable After do_check() returns, the verifier runs several instruction rewrite passes. Some of them patch or remove one instruction at a time. Each operation moves the remaining instruction and auxiliary-data arrays and adjusts all branch offsets, making the overall work quadratic in the program length. A privileged loader can submit 131072 unconditional jumps by zero followed by a valid return. Verification finishes quickly, but bpf_opt_remove_nops() then spends a long time removing each jump separately. Since this post-verification work neither checks for signals nor reschedules, a pending SIGKILL cannot terminate the task until the rewrite finishes. Make bpf_patch_insn_data() and verifier_remove_insns() common cancellation and rescheduling points. These helpers run from BPF_PROG_LOAD process context, and bpf_patch_insn_data() can already sleep while reallocating auxiliary data. Report interrupted constant blinding as -EINTR and propagate it through both JIT paths, including kernels that permit interpreter fallback. Other blinding failures retain the existing fallback behavior. This does not reduce the quadratic cost of the rewrite passes, but it makes the work preemptible and allows a killed loader to be torn down promptly.

The advisory is shared for download at git.kernel.org. This vulnerability was named CVE-2026-98628 since 09/25/2026. The exploitation appears to be easy. The attack needs to be approached locally. The exploitation needs additional levels of successful authentication. There are known technical details, but no exploit is available.

Upgrading to version 7.2.9 or 7.3-rc5 eliminates this vulnerability. Applying the patch 56dc616d7a1f7d134d3e101c455e62b0a24d0cfd/261b61d3735b042ae25634f795c4540be0fc140c is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5
• 7.2.6
• 7.2.7
• 7.2.8
• 7.3-rc1
• 7.3-rc2
• 7.3-rc3
• 7.3-rc4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion