Improper Validation of Specified Index, Position, or Offset in Input in Linux kernel - CVE-2026-98599

Vulnerability details

The vulnerability allows a local user to cause an iterator operation to access memory outside the BPF stack, potentially corrupting kernel memory.

The vulnerability exists due to improper validation of stack offsets in stack_slot_obj_get_spi() in the Linux kernel BPF verifier when validating stack pointers passed to iterator kfuncs. A local user can submit a BPF program using an fp+0 pointer that is incorrectly validated against iterator state at fp-8 because the offset calculation maps both locations to stack slot index 0, causing an effectful iterator kfunc to interpret memory outside the BPF stack as iterator state.

Affected software

How to mitigate CVE-2026-98599

External References

• https://git.kernel.org/stable/c/79a9172f3ab4ad8392c5e5c8944b9b7710ade620
• https://git.kernel.org/stable/c/89a7241fc7ecc1b5e47c3f071081e314523b8d9d

Related Security Bulletins

• Improper Validation of Specified Index, Position, or Offset in Input in Linux kernel bpf
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more