CVE-2026-98628

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98628", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.361Z", "datePublished": "2026-10-18T15:19:49.746Z", "dateUpdated": "2026-10-19T09:22:56.237Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:22:56.237Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Make post-verification instruction rewrites killable\n\nAfter do_check() returns, the verifier runs several instruction rewrite\npasses. Some of them patch or remove one instruction at a time. Each\noperation moves the remaining instruction and auxiliary-data arrays and\nadjusts all branch offsets, making the overall work quadratic in the\nprogram length.\n\nA privileged loader can submit 131072 unconditional jumps by zero followed\nby a valid return. Verification finishes quickly, but bpf_opt_remove_nops()\nthen spends a long time removing each jump separately. Since this\npost-verification work neither checks for signals nor reschedules, a pending\nSIGKILL cannot terminate the task until the rewrite finishes.\n\nMake bpf_patch_insn_data() and verifier_remove_insns() common cancellation\nand rescheduling points. These helpers run from BPF_PROG_LOAD process\ncontext, and bpf_patch_insn_data() can already sleep while reallocating\nauxiliary data.\n\nReport interrupted constant blinding as -EINTR and propagate it through\nboth JIT paths, including kernels that permit interpreter fallback.\nOther blinding failures retain the existing fallback behavior.\n\nThis does not reduce the quadratic cost of the rewrite passes, but it makes\nthe work preemptible and allows a killed loader to be torn down promptly."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/core.c", "kernel/bpf/fixups.c"], "versions": [{"version": "52875a04f4b26e7ef30a288ea096f7cfec0e93cd", "lessThan": "56dc616d7a1f7d134d3e101c455e62b0a24d0cfd", "status": "affected", "versionType": "git"}, {"version": "52875a04f4b26e7ef30a288ea096f7cfec0e93cd", "lessThan": "261b61d3735b042ae25634f795c4540be0fc140c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/core.c", "kernel/bpf/fixups.c"], "versions": [{"version": "5.1", "status": "affected"}, {"version": "0", "lessThan": "5.1", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/56dc616d7a1f7d134d3e101c455e62b0a24d0cfd"}, {"url": "https://git.kernel.org/stable/c/261b61d3735b042ae25634f795c4540be0fc140c"}], "title": "bpf: Make post-verification instruction rewrites killable", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/bpf/core.c", "kernel/bpf/fixups.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "56dc616d7a1f7d134d3e101c455e62b0a24d0cfd", "status": "affected", "version": "52875a04f4b26e7ef30a288ea096f7cfec0e93cd", "versionType": "git"}, {"lessThan": "261b61d3735b042ae25634f795c4540be0fc140c", "status": "affected", "version": "52875a04f4b26e7ef30a288ea096f7cfec0e93cd", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/bpf/core.c", "kernel/bpf/fixups.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.1"}, {"lessThan": "5.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Make post-verification instruction rewrites killable\n\nAfter do_check() returns, the verifier runs several instruction rewrite\npasses. Some of them patch or remove one instruction at a time. Each\noperation moves the remaining instruction and auxiliary-data arrays and\nadjusts all branch offsets, making the overall work quadratic in the\nprogram length.\n\nA privileged loader can submit 131072 unconditional jumps by zero followed\nby a valid return. Verification finishes quickly, but bpf_opt_remove_nops()\nthen spends a long time removing each jump separately. Since this\npost-verification work neither checks for signals nor reschedules, a pending\nSIGKILL cannot terminate the task until the rewrite finishes.\n\nMake bpf_patch_insn_data() and verifier_remove_insns() common cancellation\nand rescheduling points. These helpers run from BPF_PROG_LOAD process\ncontext, and bpf_patch_insn_data() can already sleep while reallocating\nauxiliary data.\n\nReport interrupted constant blinding as -EINTR and propagate it through\nboth JIT paths, including kernels that permit interpreter fallback.\nOther blinding failures retain the existing fallback behavior.\n\nThis does not reduce the quadratic cost of the rewrite passes, but it makes\nthe work preemptible and allows a killed loader to be torn down promptly."}], "id": "CVE-2026-98628", "lastModified": "2026-10-19T10:19:27.050", "metrics": {}, "published": "2026-10-18T16:17:15.860", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/261b61d3735b042ae25634f795c4540be0fc140c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/56dc616d7a1f7d134d3e101c455e62b0a24d0cfd"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: bpf: Make post-verification instruction rewrites killable", "id": "2555031", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555031"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-606", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: Make post-verification instruction rewrites killable\nAfter do_check() returns, the verifier runs several instruction rewrite\npasses. Some of them patch or remove one instruction at a time. Each\noperation moves the remaining instruction and auxiliary-data arrays and\nadjusts all branch offsets, making the overall work quadratic in the\nprogram length.\nA privileged loader can submit 131072 unconditional jumps by zero followed\nby a valid return. Verification finishes quickly, but bpf_opt_remove_nops()\nthen spends a long time removing each jump separately. Since this\npost-verification work neither checks for signals nor reschedules, a pending\nSIGKILL cannot terminate the task until the rewrite finishes.\nMake bpf_patch_insn_data() and verifier_remove_insns() common cancellation\nand rescheduling points. These helpers run from BPF_PROG_LOAD process\ncontext, and bpf_patch_insn_data() can already sleep while reallocating\nauxiliary data.\nReport interrupted constant blinding as -EINTR and propagate it through\nboth JIT paths, including kernels that permit interpreter fallback.\nOther blinding failures retain the existing fallback behavior.\nThis does not reduce the quadratic cost of the rewrite passes, but it makes\nthe work preemptible and allows a killed loader to be torn down promptly.", "A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. A privileged local user can cause a Denial of Service (DoS) by loading a specially crafted BPF program containing numerous redundant instructions that trigger intensive post-verification cleanup. Because these rewrite operations do not check for termination signals or yield processor time, the task enters an uninterruptible state that ignores termination requests until the work completes, leading to prolonged resource consumption."], "name": "CVE-2026-98628", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98628\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98628\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98628.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[52875a04f4b26e7ef30a288ea096f7cfec0e93cd,56dc616d7a1f7d134d3e101c455e62b0a24d0cfd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[52875a04f4b26e7ef30a288ea096f7cfec0e93cd,261b61d3735b042ae25634f795c4540be0fc140c)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T18:30:14.375356+00:00", "updated": "2026-10-23T07:30:09.339380+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}