In the Linux kernel, the following vulnerability has been resolved: bpf: Bound ownership depth through local kptrs and graph roots Program-allocated… (CVE-2026-98613)

The Linux kernel's BPF subsystem had a vulnerability where program-allocated objects could own other local objects through referenced kptrs, leading to arbitrarily deep object chains. The function bpf_obj_free_fields() recursively drops these objects synchronously before freeing storage, which could exhaust the kernel stack if chains were too deep or cyclic. The existing validation in btf_check_and_fixup_fields() did not account for local kptr edges introduced by bpf_kptr_xchg(), allowing this issue. The fix replaces the old ownership restriction with a bounded ownership walk that covers graph roots and local referenced kptrs, rejecting cycles and paths deeper than eight record-bearing types. This validation occurs after all BTF records are fixed up, ensuring safe and bounded object ownership graphs.

The vulnerability could lead to kernel stack exhaustion during object destruction in the BPF subsystem, potentially causing denial of service or kernel instability. There is no indication of remote exploitation or privilege escalation in the provided data. The issue affects kernel stability when processing certain BPF programs with complex ownership graphs.

A fix has been implemented in the Linux kernel that bounds the ownership depth and rejects overly deep or cyclic ownership chains in BPF program-allocated objects. Users should apply the official kernel update that includes this fix. No additional mitigation is indicated or required beyond applying the patch.