SB20260928151 - Always-Incorrect Control Flow Implementation in Linux kernel bpf

Description

This security bulletin contains information about 1 vulnerability.

1) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-98046)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to install a file descriptor into an interrupted task.

The vulnerability exists due to improper execution-context validation in the bpf_btf_find_by_name_kind() helper prototype when invoking the helper from a non-sleepable BPF timer callback. A local user can invoke the helper from a BPF timer callback to install a file descriptor into an interrupted task.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/17f54a8f2b9714529d56edbbe12d448ccdbbf469
• https://git.kernel.org/stable/c/29e40175617216fbd4544529f6bfb51d1ab95ba1
• https://git.kernel.org/stable/c/4d8784226bd3c6a707975081f986078f40456cec
• https://git.kernel.org/stable/c/620614bf7672130c43b3cff375525a2202f61979