{"id":"CVE-2026-98627","kind":"vulnerability","aliases":["CVE-2026-98627"],"related":[],"title":"Linux kernel BPF verifier: packet pointer displacement check can allow out-of-bounds access","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Preserve packet pointer class displacement in regsafe()\n\nregsafe() maps packet pointer IDs between states and checks that each\ncurrent register range is a subset of the corresponding explored\nregister range. It does not, however, preserve the displacement between\nregisters that share a packet pointer ID.\n\nThis is unsound because packet range is shared by ID. A bounds check on\none class member updates every member, and a later access can consume the\nrange through another member. Commit 022ac0750883 (\"bpf: use reg->var_off\ninstead of reg->off for pointers\") folded the fixed pointer offset into\nr64 and removed the old off equality check, so two individually narrower\nregisters can prune even when their displacement has changed. The\nexplored path can then license an out-of-bounds packet access on the\npruned path.\n\nRequire matching range bases for packet pointers with an ID. Together\nwith the existing ID mapping, this preserves the displacement between\nmembers of each packet-pointer class without adding per-ID state.\nPacket pointers without an ID remain unaffected.","summary":"The Linux kernel BPF verifier fails to preserve pointer displacement between registers sharing a packet pointer ID during state pruning. A crafted BPF program could then perform an out-of-bounds packet memory access.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bpf","linux-kernel","runtime","self-hosted"],"not_affected_if":["unprivileged-bpf-disabled"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel versions in the NVD entry\n- Check whether unprivileged BPF is enabled with `sysctl kernel.unprivileged_bpf_disabled`","fix":"- Update the Linux kernel to a release that includes the upstream fix for this commit (version unknown from the sources)","status":"open","published_at":"2026-10-18T16:17:15+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:21:09+00:00","updated_at":"2026-10-25T05:21:09+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:21:09Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for this commit (version unknown from the sources)","reach":"local","title":"Linux kernel BPF verifier: packet pointer displacement check can allow out-of-bounds access","impact":"high","summary":"The Linux kernel BPF verifier fails to preserve pointer displacement between registers sharing a packet pointer ID during state pruning. A crafted BPF program could then perform an out-of-bounds packet memory access.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","bpf","self-hosted"],"confidence":0.5,"needs_auth":"yes","worst_case":"local user escalates privileges via out-of-bounds kernel memory access","analyst_note":"Check NVD and the kernel stable tree for affected and fixed kernel version ranges and any severity score.","how_to_check":"- Run `uname -r` and compare against the fixed kernel versions in the NVD entry\n- Check whether unprivileged BPF is enabled with `sysctl kernel.unprivileged_bpf_disabled`","needs_analyst":true,"not_affected_if":["unprivileged-bpf-disabled"],"who_is_affected":"Systems running a Linux kernel with the eBPF verifier, especially hosts that let untrusted users load BPF programs. The sources do not name specific distributions or kernel versions, so this is unknown beyond kernels containing the referenced commit 022ac0750883 or later. Hosts where BPF loading is restricted to trusted root users carry less risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000644,"input_tokens":3567,"output_tokens":574,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-98627':18A,21A '022ac0750883':153C 'access':15A,64B,144C,204C 'add':238C 'allow':10A 'anoth':150C 'base':212C 'bound':14A,61B,132C,202C 'bpf':3A,22B,33B,52B,75C,154C 'chang':191C 'check':8A,91C,133C,178C 'class':79C,136C,236C 'commit':152C 'consum':146C 'correspond':102C 'could':54B 'craft':51B 'current':94C 'cve':16A,19A 'displac':7A,39B,80C,112C,189C,228C 'equal':177C 'even':186C 'everi':139C 'exist':222C 'explor':103C,193C 'fail':35B 'fix':167C 'fold':165C 'follow':70C 'host':29B 'howev':109C 'id':46B,87C,120C,130C,218C,223C,241C,247C 'individu':181C 'instead':159C 'kernel':2A,25B,32B,68C 'later':143C 'licens':197C 'linux':1A,24B,31B,67C 'linux-kernel':23B 'map':84C,224C 'match':210C 'member':137C,140C,151C,230C 'memori':63B 'narrow':182C 'offset':169C 'old':175C 'one':135C 'out-of-bound':11A,58B,199C 'packet':5A,44B,62B,77C,85C,118C,125C,203C,214C,234C,243C 'packet-point':233C 'path':194C,208C 'per':240C 'per-id':239C 'perform':56B 'pointer':6A,38B,45B,78C,86C,119C,164C,168C,215C,235C,244C 'preserv':37B,76C,110C,226C 'program':53B 'prune':49B,185C,207C 'r64':171C 'rang':96C,105C,126C,148C,211C 'reg':156C,161C 'regist':41B,95C,104C,114C,183C 'regsaf':82C,83C 'remain':248C 'remov':173C 'requir':209C 'resolv':74C 'runtim':26B 'self':28B 'self-host':27B 'share':42B,116C,128C 'state':48B,89C,242C 'subset':99C 'togeth':219C 'two':180C 'unaffect':249C 'unsound':123C 'updat':138C 'use':155C 'var':157C 'verifi':4A,34B 'vulner':71C 'without':237C,245C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the eBPF verifier, especially hosts that let untrusted users load BPF programs. The sources do not name specific distributions or kernel versions, so this is unknown beyond kernels containing the referenced commit 022ac0750883 or later. Hosts where BPF loading is restricted to trusted root users carry less risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98627","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98627","severity":null,"published_at":"2026-10-18T16:17:15+00:00","modified_at":"2026-10-19T10:19:26+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}