{"id":"CVE-2026-98589","kind":"vulnerability","aliases":["CVE-2026-98589"],"related":[],"title":"Linux kernel: BPF verifier lets packet pointers reach mutating subprograms","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject pkt arguments in mutating subprogs\n\nThe verifier tracks changes in how PTR_TO_PACKET registers'\nbounds are modified across subprog boundaries. PTR_TO_PACKET\nregisters are actually passed as PTR_TO_MEM, which is assumed\nvalid for the entire call. This is not the case with packet memory,\nwhere a pskb_* call may invalidate its memory region.\n\nReject BPF code that passes PTR_TO_PACKET pointers to subprogs that\nmay mutate a packet. We cannot pass the pointer as a true PTR_TO_PACKET\nbecause we would also need to somehow pass the PTR_TO_PACKET_META\nor PTR_TO_PACKET_END to the subprog. Since we cannot avoid representing\nthe pointer in the subprog as PTR_TO_MEM, only permit it if the\nsubprog is guaranteed not to mutate the packet.","summary":"The BPF verifier in the Linux kernel could pass packet pointers into subprograms that may modify the packet, so a pointer can be left pointing at memory a pskb_* call has invalidated. The fix makes the verifier reject such programs unless the subprogram is guaranteed not to mutate the packet.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bpf","ebpf","infrastructure","kernel","linux"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:11+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:21:44+00:00","updated_at":"2026-10-25T05:21:44+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:21:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: BPF verifier lets packet pointers reach mutating subprograms","impact":"medium","summary":"The BPF verifier in the Linux kernel could pass packet pointers into subprograms that may modify the packet, so a pointer can be left pointing at memory a pskb_* call has invalidated. The fix makes the verifier reject such programs unless the subprogram is guaranteed not to mutate the packet.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","bpf","ebpf"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; sources do not state the impact","analyst_note":"Check the NVD entry and the upstream kernel commit for affected version ranges, the stable fix commits, and whether the flaw is reachable by unprivileged users.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000547,"input_tokens":3546,"output_tokens":384,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98589':13A,16A 'across':102C 'actual':110C 'also':171C 'argument':85C 'assum':118C 'avoid':192C 'bound':99C 'boundari':104C 'bpf':3A,17B,23B,82C,142C 'call':51B,123C,135C 'cannot':158C,191C 'case':128C 'chang':92C 'code':143C 'could':29B 'cve':11A,14A 'ebpf':18B 'end':185C 'entir':122C 'fix':55B 'follow':77C 'guarante':66B,210C 'infrastructur':19B 'invalid':53B,137C 'kernel':2A,20B,28B,75C 'left':45B 'let':5A 'linux':1A,21B,27B,74C 'make':56B 'may':36B,136C,153C 'mem':115C,202C 'memori':48B,131C,139C 'meta':180C 'modifi':37B,101C 'mutat':9A,69B,87C,154C,213C 'need':172C 'packet':6A,31B,39B,71B,97C,107C,130C,148C,156C,167C,179C,184C,215C 'pass':30B,111C,145C,159C,175C 'permit':204C 'pkt':84C 'point':46B 'pointer':7A,32B,42B,149C,161C,195C 'program':61B 'pskb':50B,134C 'ptr':95C,105C,113C,146C,165C,177C,182C,200C 'reach':8A 'region':140C 'regist':98C,108C 'reject':59B,83C,141C 'repres':193C 'resolv':81C 'sinc':189C 'somehow':174C 'subprog':88C,103C,151C,188C,198C,208C 'subprogram':10A,34B,64B 'track':91C 'true':164C 'unless':62B 'valid':119C 'verifi':4A,24B,58B,90C 'vulner':78C 'would':170C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98589","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98589","severity":null,"published_at":"2026-10-18T16:17:11+00:00","modified_at":"2026-10-19T10:19:19+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}