In the Linux kernel, the following vulnerability has been resolved: bpf: Check params size before reading reserved fields bpf_crypto_ctx_create() is… (CVE-2026-98611)

The Linux kernel's bpf_crypto_ctx_create() function is a kernel function whose second argument is annotated with __sz, indicating the verifier guarantees only params__sz bytes are valid. However, the function read reserved fields at offsets 14 and 15 before verifying that params__sz was large enough to cover the entire struct bpf_crypto_params. This allowed a BPF program to pass a shorter buffer and cause the kernel to read memory beyond the validated region. The vulnerability was resolved by moving the size check to precede the reserved field reads, preventing out-of-bounds memory access.

A BPF program could cause the kernel to read memory beyond the validated buffer, potentially leading to information disclosure or kernel memory corruption. No known exploits in the wild have been reported.

A fix has been implemented that moves the parameter size check before reading reserved fields in bpf_crypto_ctx_create(). Users should apply the official kernel update containing this fix once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.