SB20261022177 - Improper Validation of Specified Index, Position, or Offset in Input in Linux kernel bpf

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Validation of Specified Index, Position, or Offset in Input (CVE-ID: CVE-2026-98599)

CWE-ID: CWE-1285 - Improper Validation of Specified Index, Position, or Offset in Input

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an iterator operation to access memory outside the BPF stack, potentially corrupting kernel memory.

The vulnerability exists due to improper validation of stack offsets in stack_slot_obj_get_spi() in the Linux kernel BPF verifier when validating stack pointers passed to iterator kfuncs. A local user can submit a BPF program using an fp+0 pointer that is incorrectly validated against iterator state at fp-8 because the offset calculation maps both locations to stack slot index 0, causing an effectful iterator kfunc to interpret memory outside the BPF stack as iterator state.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/79a9172f3ab4ad8392c5e5c8944b9b7710ade620
• https://git.kernel.org/stable/c/89a7241fc7ecc1b5e47c3f071081e314523b8d9d