SB20260928149 - Always-Incorrect Control Flow Implementation in Linux kernel bpf

Description

This security bulletin contains information about 1 vulnerability.

1) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-98044)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a BPF verifier warning and make BPF program loading fail.

The vulnerability exists due to improper callback-context validation in the BPF verifier's check_ld_abs() handling when loading a BPF program that uses legacy BPF_LD_ABS or BPF_LD_IND instructions from synchronous callbacks. A local privileged user can load a crafted BPF program to trigger the verifier warning and an -EFAULT BPF_PROG_LOAD failure.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/3484a99303912db62428494a9061212049027e57
• https://git.kernel.org/stable/c/bc489c0c9b8c86bd7fac42cfd1bb152f042fca56
• https://git.kernel.org/stable/c/e7d28823c662128caae63f14e16bd394916c139b