In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: set up the frame pointer for the exception callback A program acting… (CVE-2026-98641)

The Linux kernel BPF subsystem on arm64 had a vulnerability where the exception callback path did not set the frame pointer register (x25) correctly. Because the callback prologue skipped push_callee_regs(), the frame pointer was not updated and retained the value from a subprogram's frame that never returned. Stack accesses through BPF_REG_FP were rewritten relative to the stack pointer, but materializing the register passed stale addresses to helpers. This allowed helpers to write over their own return address, causing kernel panics. The patch sets ctx->fp_used on the exception callback path so that x25 is set from the stack pointer, restoring correct frame pointer behavior and preventing the issue.

The vulnerability could lead to kernel panics or fatal exceptions due to helpers overwriting their own return addresses when handling BPF exception callbacks on arm64. This undermines kernel stability and could potentially be leveraged to disrupt system operation. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to set the frame pointer correctly on the exception callback path for arm64 BPF programs. Users should apply the official kernel updates that include this patch to remediate the vulnerability. No additional mitigation steps are indicated.