{"id":"CVE-2026-98611","kind":"vulnerability","aliases":["CVE-2026-98611"],"related":[],"title":"Linux kernel: BPF crypto kfunc reads past validated buffer size","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check params size before reading reserved fields\n\nbpf_crypto_ctx_create() is a kfunc whose second argument is declared\nwith the __sz annotation, so the verifier only guarantees that\nparams__sz bytes of params are valid.  The function nevertheless reads\nparams->reserved[0] and params->reserved[1] (offsets 14 and 15) before\ncomparing params__sz against the size of struct bpf_crypto_params, so a\nBPF program can pass a shorter buffer and have the kernel read past the\nregion that was validated for it.\n\nMove the size check in front of the reserved field reads.","summary":"The Linux kernel's bpf_crypto_ctx_create() kfunc reads reserved fields of its params argument before checking the buffer size, so a BPF program can pass a shorter buffer. The kernel can then read memory beyond the region the verifier validated for that argument.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bpf","linux-kernel","runtime"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:13+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:21:24+00:00","updated_at":"2026-10-25T05:21:24+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:21:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: BPF crypto kfunc reads past validated buffer size","impact":"low","summary":"The Linux kernel's bpf_crypto_ctx_create() kfunc reads reserved fields of its params argument before checking the buffer size, so a BPF program can pass a shorter buffer. The kernel can then read memory beyond the region the verifier validated for that argument.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","bpf"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel reads out-of-bounds memory during BPF crypto context creation","analyst_note":"Check the kernel.org stable commit and NVD for the fixed kernel versions and whether unprivileged BPF is needed to reach it.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000527,"input_tokens":3428,"output_tokens":368,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98611':13A,16A '0':120C '1':124C '14':126C '15':128C 'annot':100C 'argument':37B,66B,94C 'beyond':58B 'bpf':3A,17B,26B,45B,77C,85C,138C,143C 'buffer':9A,41B,51B,149C 'byte':109C 'check':39B,78C,166C 'compar':130C 'creat':29B,88C 'crypto':4A,27B,86C,139C 'ctx':28B,87C 'cve':11A,14A 'declar':96C 'field':33B,84C,172C 'follow':72C 'front':168C 'function':115C 'guarante':105C 'kernel':2A,20B,24B,53B,70C,153C 'kfunc':5A,30B,91C 'linux':1A,19B,23B,69C 'linux-kernel':18B 'memori':57B 'move':163C 'nevertheless':116C 'offset':125C 'param':36B,79C,107C,111C,118C,122C,131C,140C 'pass':48B,146C 'past':7A,155C 'program':46B,144C 'read':6A,31B,56B,82C,117C,154C,173C 'region':60B,157C 'reserv':32B,83C,119C,123C,171C 'resolv':76C 'runtim':21B 'second':93C 'shorter':50B,148C 'size':10A,42B,80C,135C,165C 'struct':137C 'sz':99C,108C,132C 'valid':8A,63B,113C,160C 'verifi':62B,103C 'vulner':73C 'whose':92C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98611","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98611","severity":null,"published_at":"2026-10-18T16:17:13+00:00","modified_at":"2026-10-19T10:19:23+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}