{"id":"CVE-2026-98626","kind":"vulnerability","aliases":["CVE-2026-98626"],"related":[],"title":"Linux kernel: malformed BPF CO-RE metadata can overwrite sensitive instructions","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Restrict CO-RE poisoning to relocatable instructions\n\nCO-RE relocation records can name any instruction offset. When a\nrelocation cannot be resolved, bpf_core_patch_insn() currently poisons its\ntarget before checking whether that instruction is a valid relocation\ntarget. Malformed metadata can therefore replace jumps, calls, exits,\nregister-source arithmetic, or non-immediate loads instead of failing at\nthe relocation step.\n\nHandle poisoning only after the instruction has passed the same class and\noperand-form checks used for a resolved relocation. Route invalid forms\nthrough the existing diagnostic and return a hard error. Keep poisoning\nsupported instructions, including both halves of a plain ldimm64, so an\nunresolved relocation in dead code remains valid.\n\nExtend bpf_core_poison_insn() to poison both halves of ldimm64, and return\nits status directly from each validated instruction case. This avoids\nrouting the success path through a common label and leaves the helper free\nto report errors.\n\nThe shared relocation code applies this restriction to both libbpf and\nin-kernel CO-RE.","summary":"Malformed CO-RE relocation records could make the BPF loader poison jumps, calls, exits or other instructions instead of failing the relocation. The sources do not say what an attacker gains from this beyond corrupting loaded BPF programs.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bpf","kernel","linux","other"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-18T16:17:15+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:21:08+00:00","updated_at":"2026-10-25T05:21:08+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-25T05:21:08Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"Linux kernel: malformed BPF CO-RE metadata can overwrite sensitive instructions","impact":"medium","summary":"Malformed CO-RE relocation records could make the BPF loader poison jumps, calls, exits or other instructions instead of failing the relocation. The sources do not say what an attacker gains from this beyond corrupting loaded BPF programs.","category":"other","nicknames":[],"who_cares":["linux","kernel","bpf"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; corrupted BPF program instructions at load time","analyst_note":"Check the NVD entry and the upstream kernel commit for severity, the affected kernel versions and the fixed stable releases.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000538,"input_tokens":3606,"output_tokens":355,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98626':15A,18A 'appli':234C 'arithmet':125C 'attack':52B 'avoid':213C 'beyond':56B 'bpf':4A,19B,31B,59B,71C,96C,192C 'call':35B,120C 'cannot':93C 'case':211C 'check':105C,153C 'class':148C 'co':6A,24B,74C,81C,245C 'co-r':5A,23B,73C,80C,244C 'code':188C,233C 'common':220C 'core':97C,193C 'corrupt':57B 'could':28B 'current':100C 'cve':13A,16A 'dead':187C 'diagnost':165C 'direct':206C 'error':170C,229C 'exist':164C 'exit':36B,121C 'extend':191C 'fail':42B,133C 'follow':66C 'form':152C,161C 'free':226C 'gain':53B 'halv':177C,199C 'handl':138C 'hard':169C 'helper':225C 'immedi':129C 'in-kernel':241C 'includ':175C 'insn':99C,195C 'instead':40B,131C 'instruct':12A,39B,79C,88C,108C,143C,174C,210C 'invalid':160C 'jump':34B,119C 'keep':171C 'kernel':2A,20B,64C,243C 'label':221C 'ldimm64':181C,201C 'leav':223C 'libbpf':239C 'linux':1A,21B,63C 'load':58B,130C 'loader':32B 'make':29B 'malform':3A,22B,114C 'metadata':8A,115C 'name':86C 'non':128C 'non-immedi':127C 'offset':89C 'operand':151C 'operand-form':150C 'overwrit':10A 'pass':145C 'patch':98C 'path':217C 'plain':180C 'poison':33B,76C,101C,139C,172C,194C,197C 'program':60B 're':7A,25B,75C,82C,246C 'record':27B,84C 'regist':123C 'register-sourc':122C 'reloc':26B,44B,83C,92C,112C,136C,158C,185C,232C 'relocat':78C 'remain':189C 'replac':118C 'report':228C 'resolv':70C,95C,157C 'restrict':72C,236C 'return':167C,203C 'rout':159C,214C 'say':49B 'sensit':11A 'share':231C 'sourc':46B,124C 'status':205C 'step':137C 'success':216C 'support':173C 'target':103C,113C 'therefor':117C 'unresolv':184C 'use':154C 'valid':111C,190C,209C 'vulner':67C 'whether':106C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98626","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98626","severity":null,"published_at":"2026-10-18T16:17:15+00:00","modified_at":"2026-10-19T10:19:26+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}