CVE-2026-98061

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98061", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:19:56.073Z", "datePublished": "2026-09-25T10:24:06.001Z", "dateUpdated": "2026-10-19T09:13:09.930Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:13:09.930Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject tail calls directly from callback frames\n\nA tail call from a non-zero frame is modeled as a return from that frame.\nThe verifier makes R0 unknown and calls prepare_func_exit() for the taken\nbranch.\n\nWhen the current frame is a synchronous callback, prepare_func_exit()\nenforces the callback return-value contract and marks R0 precise. Since the\ntail-call path synthesized R0 rather than deriving it from an instruction,\nprecision backtracking reaches the callback-calling instruction with R0\nstill requested and triggers the \"callback unexpected regs\" verifier bug.\nA CAP_BPF task can therefore cause a WARN and an -EFAULT BPF_PROG_LOAD.\n\nTail calls reachable from callbacks are already rejected later by\ncheck_max_stack_depth(). Reject a tail call made directly by a callback\nbefore constructing the inconsistent return state, using the existing\ndiagnostic. Tail calls from ordinary subprograms keep their current\nbehavior."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/verifier.c"], "versions": [{"version": "a6c22c91b6284e4713c0cf5b20ab3c9c71b77ae8", "lessThan": "617c8266e49f45747f71e74177646a63f72b7025", "status": "affected", "versionType": "git"}, {"version": "e3245f8990431950d20631c72236d4e8cb2dcde8", "lessThan": "96d31b28263c429a56e4de85bcf744a5c320b3a3", "status": "affected", "versionType": "git"}, {"version": "e3245f8990431950d20631c72236d4e8cb2dcde8", "lessThan": "266aa4ad0b2e82397cd9045752c9bff03d98eddd", "status": "affected", "versionType": "git"}, {"version": "6.18.2", "lessThan": "6.18.53", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/verifier.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.2", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/617c8266e49f45747f71e74177646a63f72b7025"}, {"url": "https://git.kernel.org/stable/c/96d31b28263c429a56e4de85bcf744a5c320b3a3"}, {"url": "https://git.kernel.org/stable/c/266aa4ad0b2e82397cd9045752c9bff03d98eddd"}], "title": "bpf: Reject tail calls directly from callback frames", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/bpf/verifier.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "617c8266e49f45747f71e74177646a63f72b7025", "status": "affected", "version": "a6c22c91b6284e4713c0cf5b20ab3c9c71b77ae8", "versionType": "git"}, {"lessThan": "96d31b28263c429a56e4de85bcf744a5c320b3a3", "status": "affected", "version": "e3245f8990431950d20631c72236d4e8cb2dcde8", "versionType": "git"}, {"lessThan": "266aa4ad0b2e82397cd9045752c9bff03d98eddd", "status": "affected", "version": "e3245f8990431950d20631c72236d4e8cb2dcde8", "versionType": "git"}, {"lessThan": "6.18.53", "status": "affected", "version": "6.18.2", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/bpf/verifier.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject tail calls directly from callback frames\n\nA tail call from a non-zero frame is modeled as a return from that frame.\nThe verifier makes R0 unknown and calls prepare_func_exit() for the taken\nbranch.\n\nWhen the current frame is a synchronous callback, prepare_func_exit()\nenforces the callback return-value contract and marks R0 precise. Since the\ntail-call path synthesized R0 rather than deriving it from an instruction,\nprecision backtracking reaches the callback-calling instruction with R0\nstill requested and triggers the \"callback unexpected regs\" verifier bug.\nA CAP_BPF task can therefore cause a WARN and an -EFAULT BPF_PROG_LOAD.\n\nTail calls reachable from callbacks are already rejected later by\ncheck_max_stack_depth(). Reject a tail call made directly by a callback\nbefore constructing the inconsistent return state, using the existing\ndiagnostic. Tail calls from ordinary subprograms keep their current\nbehavior."}], "id": "CVE-2026-98061", "lastModified": "2026-10-19T10:18:00.497", "metrics": {}, "published": "2026-09-25T11:17:35.110", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/266aa4ad0b2e82397cd9045752c9bff03d98eddd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/617c8266e49f45747f71e74177646a63f72b7025"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/96d31b28263c429a56e4de85bcf744a5c320b3a3"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Undergoing Analysis"}

{"bugzilla": {"description": "kernel: bpf: Reject tail calls directly from callback frames", "id": "2541124", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541124"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-617", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: Reject tail calls directly from callback frames\nA tail call from a non-zero frame is modeled as a return from that frame.\nThe verifier makes R0 unknown and calls prepare_func_exit() for the taken\nbranch.\nWhen the current frame is a synchronous callback, prepare_func_exit()\nenforces the callback return-value contract and marks R0 precise. Since the\ntail-call path synthesized R0 rather than deriving it from an instruction,\nprecision backtracking reaches the callback-calling instruction with R0\nstill requested and triggers the \"callback unexpected regs\" verifier bug.\nA CAP_BPF task can therefore cause a WARN and an -EFAULT BPF_PROG_LOAD.\nTail calls reachable from callbacks are already rejected later by\ncheck_max_stack_depth(). Reject a tail call made directly by a callback\nbefore constructing the inconsistent return state, using the existing\ndiagnostic. Tail calls from ordinary subprograms keep their current\nbehavior.", "A flaw was found in the Linux kernel's eBPF (Extended Berkeley Packet Filter) verifier. A privileged local user with the CAP_BPF capability can exploit this vulnerability by loading a crafted program that makes a tail call directly from within a callback function. This triggers an inconsistent internal verifier state, producing an unexpected kernel warning that can lead to a denial of service (DoS)."], "name": "CVE-2026-98061", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98061\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98061\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98061.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a6c22c91b6284e4713c0cf5b20ab3c9c71b77ae8,617c8266e49f45747f71e74177646a63f72b7025)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e3245f8990431950d20631c72236d4e8cb2dcde8,96d31b28263c429a56e4de85bcf744a5c320b3a3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e3245f8990431950d20631c72236d4e8cb2dcde8,266aa4ad0b2e82397cd9045752c9bff03d98eddd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.18.2,6.18.53)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.53,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.7,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T16:00:18.015548+00:00", "updated": "2026-09-30T14:00:07.495014+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}