CVE-2026-98045

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98045", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:19:56.071Z", "datePublished": "2026-09-25T10:23:56.089Z", "dateUpdated": "2026-10-19T09:12:51.065Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:12:51.065Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark faultable stack helpers as sleepable\n\nThe faultable variants of bpf_get_stack() and bpf_get_task_stack() pass\nmay_fault=true into the common stack collection code. Resolving user-space\nbuild IDs may then call build_id_parse_file() and block on filesystem\nreads.\n\nNeither helper prototype sets might_sleep. Since prototype selection uses\nthe sleepability of the whole program, the verifier can still allow these\nhelpers from a non-sleepable region within that program, such as an\nexplicit RCU or preemption-disabled region. The task-stack helper can also\nbe called from a non-sleepable timer callback of a sleepable program.\n\nMark both faultable prototypes as sleepable. The existing helper context\ncheck then rejects these calls while continuing to allow them in genuinely\nsleepable contexts."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/stackmap.c"], "versions": [{"version": "d4dd9775ec242425576af93daadb80a34083a53c", "lessThan": "44b8d370f2725bad215da3e67668e98ba96671bd", "status": "affected", "versionType": "git"}, {"version": "d4dd9775ec242425576af93daadb80a34083a53c", "lessThan": "3014e8a8bdad55075d89836ad9c10710a9a69837", "status": "affected", "versionType": "git"}, {"version": "d4dd9775ec242425576af93daadb80a34083a53c", "lessThan": "19e8d5a98afd071d8c1c5adeccf92b3c42eddc70", "status": "affected", "versionType": "git"}, {"version": "d4dd9775ec242425576af93daadb80a34083a53c", "lessThan": "9d02927fdf4e930893c92e35fed01a2704496900", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/stackmap.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/44b8d370f2725bad215da3e67668e98ba96671bd"}, {"url": "https://git.kernel.org/stable/c/3014e8a8bdad55075d89836ad9c10710a9a69837"}, {"url": "https://git.kernel.org/stable/c/19e8d5a98afd071d8c1c5adeccf92b3c42eddc70"}, {"url": "https://git.kernel.org/stable/c/9d02927fdf4e930893c92e35fed01a2704496900"}], "title": "bpf: Mark faultable stack helpers as sleepable", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/bpf/stackmap.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "44b8d370f2725bad215da3e67668e98ba96671bd", "status": "affected", "version": "d4dd9775ec242425576af93daadb80a34083a53c", "versionType": "git"}, {"lessThan": "3014e8a8bdad55075d89836ad9c10710a9a69837", "status": "affected", "version": "d4dd9775ec242425576af93daadb80a34083a53c", "versionType": "git"}, {"lessThan": "19e8d5a98afd071d8c1c5adeccf92b3c42eddc70", "status": "affected", "version": "d4dd9775ec242425576af93daadb80a34083a53c", "versionType": "git"}, {"lessThan": "9d02927fdf4e930893c92e35fed01a2704496900", "status": "affected", "version": "d4dd9775ec242425576af93daadb80a34083a53c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/bpf/stackmap.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"lessThan": "6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark faultable stack helpers as sleepable\n\nThe faultable variants of bpf_get_stack() and bpf_get_task_stack() pass\nmay_fault=true into the common stack collection code. Resolving user-space\nbuild IDs may then call build_id_parse_file() and block on filesystem\nreads.\n\nNeither helper prototype sets might_sleep. Since prototype selection uses\nthe sleepability of the whole program, the verifier can still allow these\nhelpers from a non-sleepable region within that program, such as an\nexplicit RCU or preemption-disabled region. The task-stack helper can also\nbe called from a non-sleepable timer callback of a sleepable program.\n\nMark both faultable prototypes as sleepable. The existing helper context\ncheck then rejects these calls while continuing to allow them in genuinely\nsleepable contexts."}], "id": "CVE-2026-98045", "lastModified": "2026-10-19T10:17:58.390", "metrics": {}, "published": "2026-09-25T11:17:33.330", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/19e8d5a98afd071d8c1c5adeccf92b3c42eddc70"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3014e8a8bdad55075d89836ad9c10710a9a69837"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/44b8d370f2725bad215da3e67668e98ba96671bd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9d02927fdf4e930893c92e35fed01a2704496900"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: bpf: Mark faultable stack helpers as sleepable", "id": "2541151", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541151"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1322", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: Mark faultable stack helpers as sleepable\nThe faultable variants of bpf_get_stack() and bpf_get_task_stack() pass\nmay_fault=true into the common stack collection code. Resolving user-space\nbuild IDs may then call build_id_parse_file() and block on filesystem\nreads.\nNeither helper prototype sets might_sleep. Since prototype selection uses\nthe sleepability of the whole program, the verifier can still allow these\nhelpers from a non-sleepable region within that program, such as an\nexplicit RCU or preemption-disabled region. The task-stack helper can also\nbe called from a non-sleepable timer callback of a sleepable program.\nMark both faultable prototypes as sleepable. The existing helper context\ncheck then rejects these calls while continuing to allow them in genuinely\nsleepable contexts.", "A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. Certain stack retrieval helper functions can perform blocking filesystem operations, but were not properly marked as sleepable. A local user with permission to load BPF programs could exploit this flaw by invoking these helpers within non-sleepable, atomic execution contexts. This context violation can trigger a kernel crash, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-98045", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98045\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98045\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98045.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d4dd9775ec242425576af93daadb80a34083a53c,44b8d370f2725bad215da3e67668e98ba96671bd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d4dd9775ec242425576af93daadb80a34083a53c,3014e8a8bdad55075d89836ad9c10710a9a69837)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d4dd9775ec242425576af93daadb80a34083a53c,19e8d5a98afd071d8c1c5adeccf92b3c42eddc70)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d4dd9775ec242425576af93daadb80a34083a53c,9d02927fdf4e930893c92e35fed01a2704496900)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T19:30:20.142021+00:00", "updated": "2026-10-01T05:15:17.467096+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}