bpf: Bound ownership depth through local kptrs and graph roots
In the Linux kernel, the following vulnerability has been resolved: bpf: Bound ownership depth through local kptrs and graph roots Program-allocated objects can own other local objects through referenced kptrs. bpf_obj_free_fields() follows those pointers through __bpf_obj_drop_impl() synchronously, before the object storage is freed through RCU. A self-referential local kptr type therefore permits arbitrarily deep object chains, and dropping the head can exhaust the kernel stack. Long acyclic type chains have the same problem. btf_check_and_fixup_fields() still assumes referenced kptrs only point to kernel types and checks ownership through list and rbtree roots only. Its existing rule is sufficient for graph-only cycles: the target of each graph edge must contain a node, so every type in a cycle has both a root and a node. The rule rejects such a type owning another root, breaking every cycle. It also limits graph-only chains to three types, or two if the first type contains a node, and conservatively rejects longer acyclic chains. The missing local-kptr edges, rather than a missed graph-only cycle, are the bug introduced by support for bpf_kptr_xchg() into local kptrs. Replace that restriction with one bounded ownership walk covering graph roots and local referenced kptrs. Run it after all BTF records have been fixed up, reject cycles and paths deeper than eight record-bearing types, and cache each type's suffix depth while checking it against the remaining budget. This al
CVE-2026-98613
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-98613
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "b0966c724584a5a9fd7fb529de19807c31f27a45",
"lessThan": "92aa0502c781d72bb9685245c3280efb3766a110",
"versionType": "git"
},
{
"status": "affected",
"version": "b0966c724584a5a9fd7fb529de19807c31f27a45",
"lessThan": "9c11e543fec32e92b3aa3f693339ca3ee79ea9dd",
"versionType": "git"
},
{
"status": "affected",
"version": "b0966c724584a5a9fd7fb529de19807c31f27a45",
"lessThan": "4105870a4b8afe852aeb24a6dd58e1836cc4ce58",
"versionType": "git"
},
{
"status": "affected",
"version": "b0966c724584a5a9fd7fb529de19807c31f27a45",
"lessThan": "bfc888f04588f591851e95c974954cfca58e6c19",
"versionType": "git"
}
],
"programFiles": [
"kernel/bpf/btf.c",
"tools/testing/selftests/bpf/prog_tests/linked_list.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.12",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"kernel/bpf/btf.c",
"tools/testing/selftests/bpf/prog_tests/linked_list.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-98613
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #38634 · Revision 1
- Added to Heist Feed
- Publisher date