In the Linux kernel, the following vulnerability has been resolved: bpf: Fix divide-by-zero in btf_struct_walk() When an access goes past the struct… (CVE-2026-98647)

The vulnerability in the Linux kernel involves the bpf_struct_walk() function used during BPF program verification. When an access goes beyond the struct and the last member is a flexible array with an element type of zero size, the function performs a modulo operation without checking for zero size, resulting in a divide-by-zero error. This can cause a kernel crash during BPF program loading. The fix rejects zero-sized element types to prevent this error.

This vulnerability can cause a kernel crash (divide error) when loading a crafted BPF program that triggers the zero-sized element type condition. It affects kernel stability and could potentially be leveraged to cause denial of service. There is no indication of code execution or privilege escalation from the provided data.

A fix has been applied to reject zero-sized element types in btf_struct_walk(), preventing the divide-by-zero error. Users should update their Linux kernel to a version that includes this fix. Since no vendor advisory or patch links are provided, check the official Linux kernel release notes or security advisories for the fixed version and apply updates accordingly.