{"id":"CVE-2026-98599","kind":"vulnerability","aliases":["CVE-2026-98599"],"related":[],"title":"Linux kernel BPF: fp+0 pointer can pass as iterator state","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject non-negative offsets in stack_slot_obj_get_spi()\n\nbpf_get_spi() computes (-off - 1) / BPF_REG_SIZE using C division,\nwhich truncates toward zero. For off == 0, this produces spi 0, the\nsame index used by the valid stack slot at fp-8.\n\nstack_slot_obj_get_spi() currently checks alignment and the resulting\nspi bounds, but does not reject the non-negative offset itself. It can\ntherefore validate a PTR_TO_STACK register holding fp+0 against an\niterator stored at fp-8 even though the runtime receives the actual fp+0\npointer. An effectful iterator kfunc can then interpret memory outside\nthe BPF stack as iterator state.\n\nReject non-negative offsets before converting the offset to an spi. All\nvalid stack objects begin at a negative offset from the frame pointer.","summary":"The kernel's BPF verifier accepts a non-negative stack offset (fp+0) as if it referred to a valid iterator stored at fp-8, because integer division truncates the slot index to zero. An attacker who can load BPF programs could make an iterator kfunc treat memory outside the BPF stack as iterator state.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bpf","linux-kernel","runtime","self-hosted"],"not_affected_if":["bpf-disabled"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-18T16:17:12+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:21:34+00:00","updated_at":"2026-10-25T05:21:34+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:21:34Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Linux kernel BPF: fp+0 pointer can pass as iterator state","impact":"high","summary":"The kernel's BPF verifier accepts a non-negative stack offset (fp+0) as if it referred to a valid iterator stored at fp-8, because integer division truncates the slot index to zero. An attacker who can load BPF programs could make an iterator kfunc treat memory outside the BPF stack as iterator state.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","bpf","self-hosted"],"confidence":0.5,"needs_auth":"yes","worst_case":"Kernel memory outside the BPF stack is treated as iterator state","analyst_note":"Check the kernel.org stable commit and the NVD entry for affected and fixed kernel versions, and whether unprivileged BPF loading is enabled by default.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["bpf-disabled"],"who_is_affected":"Systems running a Linux kernel with BPF enabled that include the stack_slot_obj_get_spi() code path. Sources do not name affected kernel versions. Systems where unprivileged or untrusted users cannot load BPF programs are less exposed; the sources do not say this explicitly.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000598,"input_tokens":3529,"output_tokens":491,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':5A,39B,173C,189C '-2026':13A,16A '-8':51B,138C,180C '-98599':14A,17A '0':122C,126C '1':109C 'accept':31B 'actual':187C 'align':146C 'attack':62B 'begin':222C 'bound':151C 'bpf':3A,18B,29B,66B,77B,92C,104C,110C,201C 'c':114C 'check':145C 'comput':107C 'convert':212C 'could':68B 'current':144C 'cve':12A,15A 'divis':54B,115C 'effect':192C 'even':181C 'follow':87C 'fp':4A,38B,50B,137C,172C,179C,188C 'frame':229C 'get':102C,105C,142C 'hold':171C 'host':25B 'index':58B,129C 'integ':53B 'interpret':197C 'iter':10A,47B,71B,80B,176C,193C,204C 'kernel':2A,21B,27B,85C 'kfunc':72B,194C 'linux':1A,20B,84C 'linux-kernel':19B 'load':65B 'make':69B 'memori':74B,198C 'negat':35B,96C,159C,209C,225C 'non':34B,95C,158C,208C 'non-neg':33B,94C,157C,207C 'obj':101C,141C 'object':221C 'offset':37B,97C,160C,210C,214C,226C 'outsid':75B,199C 'pass':8A 'pointer':6A,190C,230C 'produc':124C 'program':67B 'ptr':167C 'receiv':185C 'refer':43B 'reg':111C 'regist':170C 'reject':93C,155C,206C 'resolv':91C 'result':149C 'runtim':22B,184C 'self':24B 'self-host':23B 'size':112C 'slot':57B,100C,135C,140C 'spi':103C,106C,125C,143C,150C,217C 'stack':36B,78B,99C,134C,139C,169C,202C,220C 'state':11A,81B,205C 'store':48B,177C 'therefor':164C 'though':182C 'toward':118C 'treat':73B 'truncat':55B,117C 'use':113C,130C 'valid':46B,133C,165C,219C 'verifi':30B 'vulner':88C 'zero':60B,119C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with BPF enabled that include the stack_slot_obj_get_spi() code path. Sources do not name affected kernel versions. Systems where unprivileged or untrusted users cannot load BPF programs are less exposed; the sources do not say this explicitly.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98599","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98599","severity":null,"published_at":"2026-10-18T16:17:12+00:00","modified_at":"2026-10-19T10:19:21+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}