CVE-2026-98611 (GCVE-0-2026-98611)
Vulnerability from cvelistv5
Published
2026-10-18 15:19
Modified
2026-10-19 09:22
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Check params size before reading reserved fields bpf_crypto_ctx_create() is a kfunc whose second argument is declared with the __sz annotation, so the verifier only guarantees that params__sz bytes of params are valid. The function nevertheless reads params->reserved[0] and params->reserved[1] (offsets 14 and 15) before comparing params__sz against the size of struct bpf_crypto_params, so a BPF program can pass a shorter buffer and have the kernel read past the region that was validated for it. Move the size check in front of the reserved field reads.
References
Impacted products
Vendor Product Version
Linux Linux Version: 3e1c6f35409f9e447bf37f64840f5b65576bfb78
Version: 3e1c6f35409f9e447bf37f64840f5b65576bfb78
Version: 3e1c6f35409f9e447bf37f64840f5b65576bfb78
Version: 3e1c6f35409f9e447bf37f64840f5b65576bfb78
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/crypto.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e03253f5d65ebcd2a6d479f140c3bd9c7e4fb84a",
              "status": "affected",
              "version": "3e1c6f35409f9e447bf37f64840f5b65576bfb78",
              "versionType": "git"
            },
            {
              "lessThan": "cd12d3e08620257fbcaa262785d7f4b9473afc7a",
              "status": "affected",
              "version": "3e1c6f35409f9e447bf37f64840f5b65576bfb78",
              "versionType": "git"
            },
            {
              "lessThan": "86a0e945fb645ea90233fde239cd2de79f01974c",
              "status": "affected",
              "version": "3e1c6f35409f9e447bf37f64840f5b65576bfb78",
              "versionType": "git"
            },
            {
              "lessThan": "a11212910cf09b2fe8db9afa41ef60c4f81879c5",
              "status": "affected",
              "version": "3e1c6f35409f9e447bf37f64840f5b65576bfb78",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/crypto.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.55",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.9",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check params size before reading reserved fields\n\nbpf_crypto_ctx_create() is a kfunc whose second argument is declared\nwith the __sz annotation, so the verifier only guarantees that\nparams__sz bytes of params are valid.  The function nevertheless reads\nparams-\u003ereserved[0] and params-\u003ereserved[1] (offsets 14 and 15) before\ncomparing params__sz against the size of struct bpf_crypto_params, so a\nBPF program can pass a shorter buffer and have the kernel read past the\nregion that was validated for it.\n\nMove the size check in front of the reserved field reads."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:22:38.197Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e03253f5d65ebcd2a6d479f140c3bd9c7e4fb84a"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd12d3e08620257fbcaa262785d7f4b9473afc7a"
        },
        {
          "url": "https://git.kernel.org/stable/c/86a0e945fb645ea90233fde239cd2de79f01974c"
        },
        {
          "url": "https://git.kernel.org/stable/c/a11212910cf09b2fe8db9afa41ef60c4f81879c5"
        }
      ],
      "title": "bpf: Check params size before reading reserved fields",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98611",
    "datePublished": "2026-10-18T15:19:26.922Z",
    "dateReserved": "2026-09-25T10:25:14.360Z",
    "dateUpdated": "2026-10-19T09:22:38.197Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.