CVE-2026-98611

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98611", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.360Z", "datePublished": "2026-10-18T15:19:26.922Z", "dateUpdated": "2026-10-19T09:22:38.197Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:22:38.197Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check params size before reading reserved fields\n\nbpf_crypto_ctx_create() is a kfunc whose second argument is declared\nwith the __sz annotation, so the verifier only guarantees that\nparams__sz bytes of params are valid. The function nevertheless reads\nparams->reserved[0] and params->reserved[1] (offsets 14 and 15) before\ncomparing params__sz against the size of struct bpf_crypto_params, so a\nBPF program can pass a shorter buffer and have the kernel read past the\nregion that was validated for it.\n\nMove the size check in front of the reserved field reads."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/crypto.c"], "versions": [{"version": "3e1c6f35409f9e447bf37f64840f5b65576bfb78", "lessThan": "e03253f5d65ebcd2a6d479f140c3bd9c7e4fb84a", "status": "affected", "versionType": "git"}, {"version": "3e1c6f35409f9e447bf37f64840f5b65576bfb78", "lessThan": "cd12d3e08620257fbcaa262785d7f4b9473afc7a", "status": "affected", "versionType": "git"}, {"version": "3e1c6f35409f9e447bf37f64840f5b65576bfb78", "lessThan": "86a0e945fb645ea90233fde239cd2de79f01974c", "status": "affected", "versionType": "git"}, {"version": "3e1c6f35409f9e447bf37f64840f5b65576bfb78", "lessThan": "a11212910cf09b2fe8db9afa41ef60c4f81879c5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/crypto.c"], "versions": [{"version": "6.10", "status": "affected"}, {"version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e03253f5d65ebcd2a6d479f140c3bd9c7e4fb84a"}, {"url": "https://git.kernel.org/stable/c/cd12d3e08620257fbcaa262785d7f4b9473afc7a"}, {"url": "https://git.kernel.org/stable/c/86a0e945fb645ea90233fde239cd2de79f01974c"}, {"url": "https://git.kernel.org/stable/c/a11212910cf09b2fe8db9afa41ef60c4f81879c5"}], "title": "bpf: Check params size before reading reserved fields", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/bpf/crypto.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e03253f5d65ebcd2a6d479f140c3bd9c7e4fb84a", "status": "affected", "version": "3e1c6f35409f9e447bf37f64840f5b65576bfb78", "versionType": "git"}, {"lessThan": "cd12d3e08620257fbcaa262785d7f4b9473afc7a", "status": "affected", "version": "3e1c6f35409f9e447bf37f64840f5b65576bfb78", "versionType": "git"}, {"lessThan": "86a0e945fb645ea90233fde239cd2de79f01974c", "status": "affected", "version": "3e1c6f35409f9e447bf37f64840f5b65576bfb78", "versionType": "git"}, {"lessThan": "a11212910cf09b2fe8db9afa41ef60c4f81879c5", "status": "affected", "version": "3e1c6f35409f9e447bf37f64840f5b65576bfb78", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/bpf/crypto.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check params size before reading reserved fields\n\nbpf_crypto_ctx_create() is a kfunc whose second argument is declared\nwith the __sz annotation, so the verifier only guarantees that\nparams__sz bytes of params are valid. The function nevertheless reads\nparams->reserved[0] and params->reserved[1] (offsets 14 and 15) before\ncomparing params__sz against the size of struct bpf_crypto_params, so a\nBPF program can pass a shorter buffer and have the kernel read past the\nregion that was validated for it.\n\nMove the size check in front of the reserved field reads."}], "id": "CVE-2026-98611", "lastModified": "2026-10-19T10:19:23.283", "metrics": {}, "published": "2026-10-18T16:17:13.927", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/86a0e945fb645ea90233fde239cd2de79f01974c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a11212910cf09b2fe8db9afa41ef60c4f81879c5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cd12d3e08620257fbcaa262785d7f4b9473afc7a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e03253f5d65ebcd2a6d479f140c3bd9c7e4fb84a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: bpf: Check params size before reading reserved fields", "id": "2554954", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554954"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: Check params size before reading reserved fields\nbpf_crypto_ctx_create() is a kfunc whose second argument is declared\nwith the __sz annotation, so the verifier only guarantees that\nparams__sz bytes of params are valid. The function nevertheless reads\nparams->reserved[0] and params->reserved[1] (offsets 14 and 15) before\ncomparing params__sz against the size of struct bpf_crypto_params, so a\nBPF program can pass a shorter buffer and have the kernel read past the\nregion that was validated for it.\nMove the size check in front of the reserved field reads.", "A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. The bpf_crypto_ctx_create() function attempts to read reserved fields from a parameter structure prior to verifying that the supplied buffer is sufficiently large. A local user capable of loading BPF programs can exploit this issue by supplying an undersized buffer, causing an out-of-bounds read from kernel memory. This flaw could lead to the exposure of sensitive kernel information or trigger a system crash resulting in a Denial of Service (DoS)."], "name": "CVE-2026-98611", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98611\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98611\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98611.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3e1c6f35409f9e447bf37f64840f5b65576bfb78,e03253f565ebcd2a6d479f140c3bd9c7e4fb84a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3e1c6f35409f9e447bf37f64840f5b65576bfb78,cd12d3e08620257fbcaa262785d7f4b9473afc7a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3e1c6f35409f9e447bf37f64840f5b65576bfb78,86a0e945fb645ea90233fde239cd2de79f01974c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3e1c6f35409f9e447bf37f64840f5b65576bfb78,a11212910cf09b2fe8db9afa41ef60c4f81879c5)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "calver", "value": "6.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T22:45:04.780534+00:00", "updated": "2026-10-22T22:45:13.856034+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}