VulnerabilityPublished 18 Oct 2026

CVE-2026-98628: Linux kernel · bpf: Make post-verification instruction rewrites killable

Source GCVE Database

Authoritative record:CVE-2026-98628· Medium

Not known to be exploited : upgrade to 261b61d3735b042ae25634f795c4540be0fc140c or 56dc616d7a1f7d134d3e101c455e62b0a24d0cfd when convenient.

Data as of 26 Oct 2026, 12:55 UTC

Severity

Medium

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 8% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 261b61d3735b042ae25634f795c4540be0fc140c, 56dc616d7a1f7d134d3e101c455e62b0a24d0cfd

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-mq6p-2mw2-mp6g

What to do

Upgrade Linux kernel to 261b61d3735b042ae25634f795c4540be0fc140c or 56dc616d7a1f7d134d3e101c455e62b0a24d0cfd.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 52875a04f4b26e7ef30a288ea096f7cfec0e93cd, < 261b61d3735b042ae25634f795c4540be0fc140c	Fixed in 261b61d3735b042ae25634f795c4540be0fc140c
LinuxLinux	Affected ≥ 52875a04f4b26e7ef30a288ea096f7cfec0e93cd, < 56dc616d7a1f7d134d3e101c455e62b0a24d0cfd	Fixed in 56dc616d7a1f7d134d3e101c455e62b0a24d0cfd
LinuxLinux	Affected =5.1	Fixed in–

AI-suggested

A fix has been implemented in the Linux kernel to make the post-verification instruction rewrites interruptible and killable. Users should update to a kernel version that includes this patch. No additional mitigation is required as the patch addresses the issue directly.

Description

A vulnerability in the Linux kernel's BPF verifier was resolved by making post-verification instruction rewrites interruptible. Previously, after verification, certain instruction rewrite passes could take a long time and were not preemptible, causing a task to be unkillable during this period. The fix introduces cancellation and rescheduling points during these rewrites, allowing a killed loader to be terminated promptly.

Impact

The vulnerability could cause a privileged loader process to become unresponsive to termination signals during BPF program verification, potentially leading to denial of service by making the loader unkillable for an extended period. The fix improves system responsiveness by allowing the verification process to be interrupted and terminated promptly. There is no indication of code execution or privilege escalation impact.

Summary

The Linux kernel's BPF verifier performs instruction rewrite passes after do_check() returns. Some passes patch or remove instructions one at a time, moving instruction and auxiliary-data arrays and adjusting branch offsets, resulting in quadratic time complexity relative to program length. A privileged loader can exploit this by submitting many unconditional jumps, causing the verifier to spend excessive time removing each jump separately. Since the post-verification work did not check for signals or reschedule, a pending SIGKILL could not terminate the task until completion. The patch makes bpf_patch_insn_data() and verifier_remove_insns() common cancellation and rescheduling points, allowing the process to be interrupted and killed promptly. Interrupted constant blinding is reported as -EINTR and propagated through JIT paths, improving responsiveness without reducing the quadratic cost of rewrites.

References

Community reviews

Loading reviews…