---
id: "CVE-2026-98626"
kind: "vulnerability"
aliases: ["CVE-2026-98626"]
title: "Linux kernel: malformed BPF CO-RE metadata can overwrite sensitive instructions"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["bpf", "kernel", "linux", "other"]
not_affected_if: []
published_at: "2026-10-18T16:17:15+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:21:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98626", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel: malformed BPF CO-RE metadata can overwrite sensitive instructions

Malformed CO-RE relocation records could make the BPF loader poison jumps, calls, exits or other instructions instead of failing the relocation. The sources do not say what an attacker gains from this beyond corrupting loaded BPF programs.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98626

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

bpf: Restrict CO-RE poisoning to relocatable instructions

CO-RE relocation records can name any instruction offset. When a
relocation cannot be resolved, bpf_core_patch_insn() currently poisons its
target before checking whether that instruction is a valid relocation
target. Malformed metadata can therefore replace jumps, calls, exits,
register-source arithmetic, or non-immediate loads instead of failing at
the relocation step.

Handle poisoning only after the instruction has passed the same class and
operand-form checks used for a resolved relocation. Route invalid forms
through the existing diagnostic and return a hard error. Keep poisoning
supported instructions, including both halves of a plain ldimm64, so an
unresolved relocation in dead code remains valid.

Extend bpf_core_poison_insn() to poison both halves of ldimm64, and return
its status directly from each validated instruction case. This avoids
routing the success path through a common label and leaves the helper free
to report errors.

The shared relocation code applies this restriction to both libbpf and
in-kernel CO-RE.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_