VulnerabilityPublished 25 Sep 2026Updated 19 Oct 2026

CVE-2026-98061: Linux kernel · bpf: Reject tail calls directly from callback frames

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in 617c8266e49f45747f71e74177646a63f72b7025 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 14:05 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 9% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 617c8266e49f45747f71e74177646a63f72b7025, 266aa4ad0b2e82397cd9045752c9bff03d98eddd, 96d31b28263c429a56e4de85bcf744a5c320b3a3 +1

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to 617c8266e49f45747f71e74177646a63f72b7025, 266aa4ad0b2e82397cd9045752c9bff03d98eddd, 96d31b28263c429a56e4de85bcf744a5c320b3a3 or 6.18.53.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected >=6.18.2 <6.18.53	Fixed in 617c8266e49f45747f71e74177646a63f72b7025 266aa4ad0b2e82397cd9045752c9bff03d98eddd 96d31b28263c429a56e4de85bcf744a5c320b3a3 6.18.53
LinuxLinux	Affected =6.19	Fixed in–

AI-suggested

Upgrade affected Linux kernel versions to 6.18.53 or later where the issue is fixed. The fix rejects problematic tail calls early in the verifier to prevent inconsistent states. No additional mitigation is required beyond applying the official kernel update.

Description

CVE-2026-98061 is a vulnerability in the Linux kernel's BPF subsystem where tail calls directly from callback frames are improperly handled. This flaw causes the BPF verifier to encounter an inconsistent return state, leading to a verifier bug that triggers a kernel warning and causes BPF program load failures with an -EFAULT error. The issue affects Linux kernel versions from 6.18.2 up to but not including 6.18.53, and version 6.19. It has been fixed in version 6.18.53. Tail calls from ordinary subprograms remain unaffected.

Impact

An attacker with CAP_BPF capability can cause the Linux kernel to emit warnings and fail to load BPF programs due to the verifier bug. This leads to denial of service for BPF program loading but does not indicate code execution or privilege escalation. No known exploits are reported in the wild.

Summary

The vulnerability arises because the Linux kernel's BPF verifier incorrectly models tail calls made directly from synchronous callback frames. When such a tail call occurs, the verifier synthesizes a return value (R0) rather than deriving it from an instruction, causing precision backtracking to fail and triggering a verifier bug labeled "callback unexpected regs." This results in a kernel warning (WARN) and an -EFAULT error during BPF program loading for tasks with CAP_BPF capability. The fix involves rejecting tail calls made directly by callbacks before constructing the inconsistent return state, using existing diagnostic mechanisms. Tail calls reachable from callbacks are already rejected later by stack depth checks, and tail calls from normal subprograms retain their behavior.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 12:52 UTC

Technical details

References

Community reviews

Related threats