In the Linux kernel, the following vulnerability has been resolved: bpf: Make post-verification instruction rewrites killable After do_check()… (CVE-2026-98628)

The Linux kernel's BPF verifier performs instruction rewrite passes after do_check() returns. Some passes patch or remove instructions one at a time, moving instruction and auxiliary-data arrays and adjusting branch offsets, resulting in quadratic time complexity relative to program length. A privileged loader can exploit this by submitting many unconditional jumps, causing the verifier to spend excessive time removing each jump separately. Since the post-verification work did not check for signals or reschedule, a pending SIGKILL could not terminate the task until completion. The patch makes bpf_patch_insn_data() and verifier_remove_insns() common cancellation and rescheduling points, allowing the process to be interrupted and killed promptly. Interrupted constant blinding is reported as -EINTR and propagated through JIT paths, improving responsiveness without reducing the quadratic cost of rewrites.

The vulnerability could cause a privileged loader process to become unresponsive to termination signals during BPF program verification, potentially leading to denial of service by making the loader unkillable for an extended period. The fix improves system responsiveness by allowing the verification process to be interrupted and terminated promptly. There is no indication of code execution or privilege escalation impact.

A fix has been implemented in the Linux kernel to make the post-verification instruction rewrites interruptible and killable. Users should update to a kernel version that includes this patch. No additional mitigation is required as the patch addresses the issue directly.