Live › vulnerability › CVE-2026-98599
Go to dashboardThe kernel's BPF verifier accepts a non-negative stack offset (fp+0) as if it referred to a valid iterator stored at fp-8, because integer division truncates the slot index to zero. An attacker who can load BPF programs could make an iterator kfunc treat memory outside the BPF stack as iterator state.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with BPF enabled that include the stack_slot_obj_get_spi() code path. Sources do not name affected kernel versions. Systems where unprivileged or untrusted users cannot load BPF programs are less exposed; the sources do not say this explicitly.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject non-negative offsets in stack_slot_obj_get_spi()
bpf_get_spi() computes (-off - 1) / BPF_REG_SIZE using C division, which truncates toward zero. For off == 0, this produces spi 0, the same index used by the valid stack slot at fp-8.
stack_slot_obj_get_spi() currently checks alignment and the resulting spi bounds, but does not reject the non-negative offset itself. It can therefore validate a PTR_TO_STACK register holding fp+0 against an iterator stored at fp-8 even though the runtime receives the actual fp+0 pointer. An effectful iterator kfunc can then interpret memory outside the BPF stack as iterator state.
Reject non-negative offsets before converting the offset to an spi. All valid stack objects begin at a negative offset from the frame pointer.
This page as .md · .json · in your agent: get_signal("CVE-2026-98599")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.