SB20261022194 - Uncontrolled Recursion in Linux kernel bpf prog_tests

Description

This security bulletin contains information about 1 vulnerability.

1) Uncontrolled Recursion (CVE-ID: CVE-2026-98613)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to exhaust the kernel stack and cause a denial of service.

The vulnerability exists due to uncontrolled recursion caused by missing ownership-depth validation in the Linux kernel BPF subsystem when handling object ownership through local referenced kernel pointers. A local privileged user can construct deeply nested object ownership chains and trigger destruction of the head object to exhaust the kernel stack and cause a denial of service.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/4105870a4b8afe852aeb24a6dd58e1836cc4ce58
• https://git.kernel.org/stable/c/92aa0502c781d72bb9685245c3280efb3766a110
• https://git.kernel.org/stable/c/9c11e543fec32e92b3aa3f693339ca3ee79ea9dd
• https://git.kernel.org/stable/c/bfc888f04588f591851e95c974954cfca58e6c19