---
id: "CVE-2026-98599"
kind: "vulnerability"
aliases: ["CVE-2026-98599"]
title: "Linux kernel BPF: fp+0 pointer can pass as iterator state"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["bpf", "linux-kernel", "runtime", "self-hosted"]
not_affected_if: ["bpf-disabled"]
published_at: "2026-10-18T16:17:12+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:21:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98599", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel BPF: fp+0 pointer can pass as iterator state

The kernel's BPF verifier accepts a non-negative stack offset (fp+0) as if it referred to a valid iterator stored at fp-8, because integer division truncates the slot index to zero. An attacker who can load BPF programs could make an iterator kfunc treat memory outside the BPF stack as iterator state.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98599

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject non-negative offsets in stack_slot_obj_get_spi()

bpf_get_spi() computes (-off - 1) / BPF_REG_SIZE using C division,
which truncates toward zero. For off == 0, this produces spi 0, the
same index used by the valid stack slot at fp-8.

stack_slot_obj_get_spi() currently checks alignment and the resulting
spi bounds, but does not reject the non-negative offset itself. It can
therefore validate a PTR_TO_STACK register holding fp+0 against an
iterator stored at fp-8 even though the runtime receives the actual fp+0
pointer. An effectful iterator kfunc can then interpret memory outside
the BPF stack as iterator state.

Reject non-negative offsets before converting the offset to an spi. All
valid stack objects begin at a negative offset from the frame pointer.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_