bpf: Reject legacy packet loads from callbacks
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject legacy packet loads from callbacks check_ld_abs() models a failed BPF_LD_ABS or BPF_LD_IND in a subprogram as an implicit return with R0 set to zero. It calls prepare_func_exit() to explore this synthesized path. When the load is reached directly from a synchronous callback, prepare_func_exit() enforces the callback return contract and marks R0 precise. R0 is not derived from a real instruction on this path, so precision backtracking reaches the callback call with R0 still requested and triggers the "callback unexpected regs" verifier bug. A privileged program loader can therefore cause a verifier warning and an -EFAULT BPF_PROG_LOAD. These legacy packet-load instructions are deprecated. Reject them from callbacks rather than complicating their implicit-return model. Check all active frames before constructing the implicit return so nested static subprograms cannot hide the callback context. Global functions are verified independently with a fresh frame zero, so an active-frame check cannot identify a global function called from a callback. Also check the complete subprogram call graph during stack-depth validation and reject a function containing a legacy load when any caller is a callback. This covers global and static descendants without making has_ld_abs transitive, preserving its per-function BTF return-type check. Ordinary uses outside callbacks remain supported.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 6.12.114, 6.18.53, 7.2.7
- CVEs
- CVE-2026-98044
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 5 Nov 2026, 06:13 UTC · Revision 1
Source evidence
bpf: Reject legacy packet loads from callbacks
core-osv · Original sourcePublished 25 Sept 2026, 10:23 UTC
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject legacy packet loads from callbacks check_ld_abs() models a failed BPF_LD_ABS or BPF_LD_IND in a subprogram as an implicit return with R0 set to zero. It calls prepare_func_exit() to explore this synthesized path. When the load is reached directly from a synchronous callback, prepare_func_exit() enforces the callback return contract and marks R0 precise. R0 is not derived from a real instruction on this path, so precision backtracking reaches the callback call with R0 still requested and triggers the "callback unexpected regs" verifier bug. A privileged program loader can therefore cause a verifier warning and an -EFAULT BPF_PROG_LOAD. These legacy packet-load instructions are deprecated. Reject them from callbacks rather than complicating their implicit-return model. Check all active frames before constructing the implicit return so nested static subprograms cannot hide the callback context. Global functions are verified independently with a fresh frame zero, so an active-frame check cannot identify a global function called from a callback. Also check the complete subprogram call graph during stack-depth validation and reject a function containing a legacy load when any caller is a callback. This covers global and static descendants without making has_ld_abs transitive, preserving its per-function BTF return-type check. Ordinary uses outside callbacks remain supported.
osv:CVE-2026-98044
Kernel
Fixed versions: 6.12.114, 6.18.53, 7.2.7
Complete source record
{
"id": "0e048b7d6a63c69c0ba55588d6b16c36f19fdc85baea7dd491977525bd28e05e",
"url": "https://osv.dev/vulnerability/CVE-2026-98044",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "bpf: Reject legacy packet loads from callbacks",
"summary": "In the Linux kernel, the following vulnerability has been resolved: bpf: Reject legacy packet loads from callbacks check_ld_abs() models a failed BPF_LD_ABS or BPF_LD_IND in a subprogram as an implicit return with R0 set to zero. It calls prepare_func_exit() to explore this synthesized path. When the load is reached directly from a synchronous callback, prepare_func_exit() enforces the callback return contract and marks R0 precise. R0 is not derived from a real instruction on this path, so precision backtracking reaches the callback call with R0 still requested and triggers the \"callback unexpected regs\" verifier bug. A privileged program loader can therefore cause a verifier warning and an -EFAULT BPF_PROG_LOAD. These legacy packet-load instructions are deprecated. Reject them from callbacks rather than complicating their implicit-return model. Check all active frames before constructing the implicit return so nested static subprograms cannot hide the callback context. Global functions are verified independently with a fresh frame zero, so an active-frame check cannot identify a global function called from a callback. Also check the complete subprogram call graph during stack-depth validation and reject a function containing a legacy load when any caller is a callback. This covers global and static descendants without making has_ld_abs transitive, preserving its per-function BTF return-type check. Ordinary uses outside callbacks remain supported.",
"evidence": "osv:CVE-2026-98044",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.12.114",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.53",
"evidence": "/affected/1/ranges"
},
{
"value": "7.2.7",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2026-98044",
"aliases": [
"CVE-2026-98044"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "8674e2db06cff6b50f2216eed9a761d15425bb34"
},
{
"fixed": "cebda2a2bb4183550eae9dcf888c16407b4fffda"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337"
},
{
"fixed": "3484a99303912db62428494a9061212049027e57"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "ee861486e377edc55361c08dcbceab3f6b6577bd"
},
{
"fixed": "bc489c0c9b8c86bd7fac42cfd1bb152f042fca56"
},
{
"fixed": "e7d28823c662128caae63f14e16bd394916c139b"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.12.101"
},
{
"fixed": "6.12.114"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.18.42"
},
{
"fixed": "6.18.53"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.10.265"
},
{
"fixed": "5.11"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.15.216"
},
{
"fixed": "5.16"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.1.183"
},
{
"fixed": "6.2"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.6.148"
},
{
"fixed": "6.7"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "7.0.10"
},
{
"fixed": "7.1"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "928d354ae3557e8f755a227e67be88034eb3cd7f"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbe"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "de1055e7f9e67af32b1f3376066272b04e5223c0"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "37ad2bb11e9de92cb7b94548705eeedd87f7d392"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "d846d83bdacbd8f14fc45c63b8c1d22608452e1c"
}
]
}
],
"versions": [
"v6.12.113",
"v6.12.112",
"v6.12.111",
"v6.12.110",
"v6.12.109",
"v6.12.108",
"v6.12.107",
"v6.12.106",
"v6.12.105",
"v6.12.104",
"v6.12.103",
"v6.12.102",
"v6.12.101",
"v6.18.52",
"v6.18.51",
"v6.18.50",
"v6.18.49",
"v6.18.48",
"v6.18.47",
"v6.18.46",
"v6.18.45",
"v6.18.44",
"v6.18.43",
"v6.18.42",
"v5.10.272",
"v5.10.271",
"v5.10.270",
"v5.10.269",
"v5.10.268",
"v5.10.267",
"v5.10.266",
"v5.10.265",
"v5.15.223",
"v5.15.222",
"v5.15.221",
"v5.15.220",
"v5.15.219",
"v5.15.218",
"v5.15.217",
"v5.15.216",
"v6.1.190",
"v6.1.189",
"v6.1.188",
"v6.1.187",
"v6.1.186",
"v6.1.185",
"v6.1.184",
"v6.1.183",
"v6.6.160",
"v6.6.159",
"v6.6.158",
"v6.6.157",
"v6.6.156",
"v6.6.155",
"v6.6.154",
"v6.6.153",
"v6.6.152",
"v6.6.151",
"v6.6.150",
"v6.6.149",
"v6.6.148",
"v7.0.14",
"v7.0.13",
"v7.0.12",
"v7.0.11",
"v7.0.10"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98044.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.12.114"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.53"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "7.2.7"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98044.json"
}
}
],
"modified": "2026-10-28T02:30:43.006480450Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/3484a99303912db62428494a9061212049027e57",
"https://git.kernel.org/stable/c/bc489c0c9b8c86bd7fac42cfd1bb152f042fca56",
"https://git.kernel.org/stable/c/cebda2a2bb4183550eae9dcf888c16407b4fffda",
"https://git.kernel.org/stable/c/e7d28823c662128caae63f14e16bd394916c139b",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98044.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-98044",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98044.json"
}
},
"related_cves": [
{
"value": "CVE-2026-98044",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 511014,
"published_at": "2026-09-25T10:23:55.454+00:00"
}