CVE-2026-98613 (GCVE-0-2026-98613)
Vulnerability from cvelistv5
Published
2026-10-18 15:19
Modified
2026-10-19 09:22
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Bound ownership depth through local kptrs and graph roots Program-allocated objects can own other local objects through referenced kptrs. bpf_obj_free_fields() follows those pointers through __bpf_obj_drop_impl() synchronously, before the object storage is freed through RCU. A self-referential local kptr type therefore permits arbitrarily deep object chains, and dropping the head can exhaust the kernel stack. Long acyclic type chains have the same problem. btf_check_and_fixup_fields() still assumes referenced kptrs only point to kernel types and checks ownership through list and rbtree roots only. Its existing rule is sufficient for graph-only cycles: the target of each graph edge must contain a node, so every type in a cycle has both a root and a node. The rule rejects such a type owning another root, breaking every cycle. It also limits graph-only chains to three types, or two if the first type contains a node, and conservatively rejects longer acyclic chains. The missing local-kptr edges, rather than a missed graph-only cycle, are the bug introduced by support for bpf_kptr_xchg() into local kptrs. Replace that restriction with one bounded ownership walk covering graph roots and local referenced kptrs. Run it after all BTF records have been fixed up, reject cycles and paths deeper than eight record-bearing types, and cache each type's suffix depth while checking it against the remaining budget. This also permits the longer acyclic graph-only layouts rejected by the old rule; update their existing BTF tests accordingly. Keep the bound independent of MAX_CALL_FRAMES because recursive destruction can run below a BPF call chain. A plain local pointee without special-field metadata adds only a final non-recursing drop. Non-owning kptrs and kernel-BTF kptrs do not recurse through local records and remain outside the walk. Include local percpu-kptr edges too, although allocation of percpu objects with special fields is currently forbidden, so that relaxing that restriction cannot bypass the ownership bound. btf_check_and_fixup_fields() continues to initialize graph_root.value_rec, including for separately allocated map records. The ownership relationships belong to immutable program BTF and only need validation at BTF load time.
References
Impacted products
Vendor Product Version
Linux Linux Version: b0966c724584a5a9fd7fb529de19807c31f27a45
Version: b0966c724584a5a9fd7fb529de19807c31f27a45
Version: b0966c724584a5a9fd7fb529de19807c31f27a45
Version: b0966c724584a5a9fd7fb529de19807c31f27a45
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/btf.c",
            "tools/testing/selftests/bpf/prog_tests/linked_list.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "92aa0502c781d72bb9685245c3280efb3766a110",
              "status": "affected",
              "version": "b0966c724584a5a9fd7fb529de19807c31f27a45",
              "versionType": "git"
            },
            {
              "lessThan": "9c11e543fec32e92b3aa3f693339ca3ee79ea9dd",
              "status": "affected",
              "version": "b0966c724584a5a9fd7fb529de19807c31f27a45",
              "versionType": "git"
            },
            {
              "lessThan": "4105870a4b8afe852aeb24a6dd58e1836cc4ce58",
              "status": "affected",
              "version": "b0966c724584a5a9fd7fb529de19807c31f27a45",
              "versionType": "git"
            },
            {
              "lessThan": "bfc888f04588f591851e95c974954cfca58e6c19",
              "status": "affected",
              "version": "b0966c724584a5a9fd7fb529de19807c31f27a45",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/btf.c",
            "tools/testing/selftests/bpf/prog_tests/linked_list.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.55",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.9",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Bound ownership depth through local kptrs and graph roots\n\nProgram-allocated objects can own other local objects through referenced\nkptrs. bpf_obj_free_fields() follows those pointers through\n__bpf_obj_drop_impl() synchronously, before the object storage is freed\nthrough RCU. A self-referential local kptr type therefore permits arbitrarily\ndeep object chains, and dropping the head can exhaust the kernel stack.\nLong acyclic type chains have the same problem.\n\nbtf_check_and_fixup_fields() still assumes referenced kptrs only point to\nkernel types and checks ownership through list and rbtree roots only. Its\nexisting rule is sufficient for graph-only cycles: the target of each graph\nedge must contain a node, so every type in a cycle has both a root and a\nnode. The rule rejects such a type owning another root, breaking every\ncycle. It also limits graph-only chains to three types, or two if the first\ntype contains a node, and conservatively rejects longer acyclic chains.\nThe missing local-kptr edges, rather than a missed graph-only cycle, are the\nbug introduced by support for bpf_kptr_xchg() into local kptrs.\n\nReplace that restriction with one bounded ownership walk covering graph\nroots and local referenced kptrs. Run it after all BTF records have been\nfixed up, reject cycles and paths deeper than eight record-bearing types,\nand cache each type\u0027s suffix depth while checking it against the remaining\nbudget. This also permits the longer acyclic graph-only layouts rejected\nby the old rule; update their existing BTF tests accordingly.\n\nKeep the bound independent of MAX_CALL_FRAMES because recursive destruction\ncan run below a BPF call chain. A plain local pointee without special-field\nmetadata adds only a final non-recursing drop. Non-owning kptrs and\nkernel-BTF kptrs do not recurse through local records and remain outside the\nwalk. Include local percpu-kptr edges too, although allocation of percpu\nobjects with special fields is currently forbidden, so that relaxing that\nrestriction cannot bypass the ownership bound.\n\nbtf_check_and_fixup_fields() continues to initialize graph_root.value_rec,\nincluding for separately allocated map records. The ownership relationships\nbelong to immutable program BTF and only need validation at BTF load time."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:22:41.226Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/92aa0502c781d72bb9685245c3280efb3766a110"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c11e543fec32e92b3aa3f693339ca3ee79ea9dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/4105870a4b8afe852aeb24a6dd58e1836cc4ce58"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfc888f04588f591851e95c974954cfca58e6c19"
        }
      ],
      "title": "bpf: Bound ownership depth through local kptrs and graph roots",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98613",
    "datePublished": "2026-10-18T15:19:33.624Z",
    "dateReserved": "2026-09-25T10:25:14.360Z",
    "dateUpdated": "2026-10-19T09:22:41.226Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.