{"id":"CVE-2026-98647","kind":"vulnerability","aliases":["CVE-2026-98647"],"related":[],"title":"Linux kernel: BPF verifier divide-by-zero on empty flexible array struct","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix divide-by-zero in btf_struct_walk()\n\nWhen an access goes past the struct and the last member is a flexible\narray, btf_struct_walk() folds the offset back into a single element with\n(off - moff) % t->size, but never checks that the element type has a size.\n\nBTF takes an empty struct, so this in program BTF\n\n\t/* event could be empty */\n\tstruct event {\n #ifdef HAVE_TIMESTAMP\n\t\t__u64 ts;\n #endif\n\t};\n\n\tstruct batch {\n\t\tint nr;\n\t\tstruct event events[];\n\t};\n\ndivides by zero at prog load time. Getting there needs a PTR_TO_BTF_ID that\nis not MEM_ALLOC, e.g. a plain read of a local kptr stashed in a map from a\nsleepable program.\n\nOops: divide error: 0000 [#1] SMP KASAN PTI\nRIP: 0010:btf_struct_walk+0x53f/0x1570\nCall Trace:\n <TASK>\n btf_struct_access+0x42a/0xcd0\n check_ptr_to_btf_access+0x4dc/0x1160\n check_mem_access+0x3a45/0x8740\n check_load_mem+0x36a/0xd10\n do_check_common+0x3ef0/0xb210\n bpf_check+0x6d3b/0x8580\n bpf_prog_load+0xf7c/0x2720\n __sys_bpf+0xa83/0x3690\n __x64_sys_bpf+0xc7/0x150\n x64_sys_call+0x1f3f/0x27e0\n do_syscall_64+0xe5/0x610\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n </TASK>\n\nReject a zero-sized element type. The fixed array path in the same function\nalready bails out on the same thing:\n\n\tbtf_struct_walk()\n\t...\n\t\t/* skip empty array */\n\t\tif (moff == mtrue_end)\n\t\t\tcontinue;\n\n\t\tmsize /= total_nelems;","summary":"The Linux kernel BPF verifier can divide by zero in btf_struct_walk() when a program accesses past a struct whose trailing flexible array has an empty element type. Loading a crafted BPF program can crash the kernel with an oops.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bpf","linux-kernel","linux-servers","runtime","self-hosted"],"not_affected_if":["bpf-disabled","unprivileged-bpf-disabled"],"how_to_check":"- Check the running kernel with `uname -r` and compare against the fixed kernel builds listed in the NVD or distribution advisory for CVE-2026-98647.\n- Check whether unprivileged BPF is enabled with `sysctl kernel.unprivileged_bpf_disabled`; a value of `0` lets unprivileged users load programs.","fix":"- Update the Linux kernel to a release that includes the upstream commit rejecting zero-sized element types in btf_struct_walk().\n- Until patched, set `sysctl -w kernel.unprivileged_bpf_disabled=2` to limit BPF program loading.","status":"open","published_at":"2026-10-18T16:17:17+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:20:50+00:00","updated_at":"2026-10-25T05:20:50+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:20:50Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit rejecting zero-sized element types in btf_struct_walk().\n- Until patched, set `sysctl -w kernel.unprivileged_bpf_disabled=2` to limit BPF program loading.","reach":"local","title":"Linux kernel: BPF verifier divide-by-zero on empty flexible array struct","impact":"medium","summary":"The Linux kernel BPF verifier can divide by zero in btf_struct_walk() when a program accesses past a struct whose trailing flexible array has an empty element type. Loading a crafted BPF program can crash the kernel with an oops.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","bpf","self-hosted","linux-servers"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user crashes kernel via crafted BPF program load","analyst_note":"Find the fixed kernel versions and stable backport commits in the NVD entry or the kernel git log for btf_struct_walk().","how_to_check":"- Check the running kernel with `uname -r` and compare against the fixed kernel builds listed in the NVD or distribution advisory for CVE-2026-98647.\n- Check whether unprivileged BPF is enabled with `sysctl kernel.unprivileged_bpf_disabled`; a value of `0` lets unprivileged users load programs.","needs_analyst":true,"not_affected_if":["bpf-disabled","unprivileged-bpf-disabled"],"who_is_affected":"Systems running a Linux kernel with the BPF verifier, where BPF programs can be loaded, especially hosts that allow unprivileged BPF or run sleepable BPF programs that use local kptrs. Hosts that do not load BPF programs or that lock down BPF loading are less exposed. The sources do not say which kernel versions are fixed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000735,"input_tokens":3917,"output_tokens":687,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':211C,218C,225C,230C,235C,240C,244C,249C,253C,258C,263C,268C,275C '-2026':15A,18A '-98647':16A,19A '0000':201C '0010':207C '1':202C '64':267C,272C 'access':47B,94C,217C,224C,229C 'alloc':181C 'alreadi':292C 'array':12A,54B,106C,286C,304C 'back':113C 'bail':293C 'batch':156C 'bpf':3A,20B,34B,63B,82C,242C,246C,252C,257C 'btf':41B,89C,107C,133C,142C,175C,208C,215C,223C,299C 'call':213C,262C 'check':125C,220C,227C,232C,238C,243C 'common':239C 'continu':309C 'could':144C 'craft':62B 'crash':66B 'cve':14A,17A 'divid':6A,37B,85C,162C,199C 'divide-by-zero':5A,84C 'e.g':182C 'element':58B,117C,128C,282C 'empti':10A,57B,136C,146C,303C 'end':308C 'endif':154C 'entri':270C 'error':200C 'event':143C,148C,160C,161C 'fix':83C,285C 'flexibl':11A,53B,105C 'fold':110C 'follow':77C 'function':291C 'get':169C 'goe':95C 'host':30B 'hwframe':274C 'id':176C 'ifdef':149C 'int':157C 'kasan':204C 'kernel':2A,23B,33B,68B,75C 'kptr':189C 'last':101C 'linux':1A,22B,25B,32B,74C 'linux-kernel':21B 'linux-serv':24B 'load':60B,167C,233C,248C 'local':188C 'map':193C 'mem':180C,228C,234C 'member':102C 'moff':120C,306C 'msize':310C 'mtrue':307C 'need':171C 'nelem':312C 'never':124C 'nr':158C 'offset':112C 'oop':71B,198C 'past':48B,96C 'path':287C 'plain':184C 'prog':166C,247C 'program':46B,64B,141C,197C 'pti':205C 'ptr':173C,221C 'read':185C 'reject':277C 'resolv':81C 'rip':206C 'runtim':27B 'self':29B 'self-host':28B 'server':26B 'singl':116C 'size':122C,132C,281C 'skip':302C 'sleepabl':196C 'smp':203C 'stash':190C 'struct':13A,42B,50B,90C,98C,108C,137C,147C,155C,159C,209C,216C,300C 'sys':251C,256C,261C 'syscal':266C,271C 'take':134C 'thing':298C 'time':168C 'timestamp':151C 'total':311C 'trace':214C 'trail':52B 'ts':153C 'type':59B,129C,283C 'u64':152C 'verifi':4A,35B 'vulner':78C 'walk':43B,91C,109C,210C,301C 'whose':51B 'x1f3f/0x27e0':264C 'x36a/0xd10':236C 'x3a45/0x8740':231C 'x3ef0/0xb210':241C 'x42a/0xcd0':219C 'x4dc/0x1160':226C 'x53f/0x1570':212C 'x64':255C,260C 'x6d3b/0x8580':245C 'x76/0x7e':276C 'xa83/0x3690':254C 'xc7/0x150':259C 'xe5/0x610':269C 'xf7c/0x2720':250C 'zero':8A,39B,87C,164C,280C 'zero-s':279C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the BPF verifier, where BPF programs can be loaded, especially hosts that allow unprivileged BPF or run sleepable BPF programs that use local kptrs. Hosts that do not load BPF programs or that lock down BPF loading are less exposed. The sources do not say which kernel versions are fixed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98647","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98647","severity":null,"published_at":"2026-10-18T16:17:17+00:00","modified_at":"2026-10-19T10:19:29+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}