In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve packet pointer class displacement in regsafe() regsafe() maps… (CVE-2026-98627)

The vulnerability in the Linux kernel's BPF verifier involves the regsafe() function, which maps packet pointer IDs between states and checks register ranges. It failed to preserve displacement between registers sharing a packet pointer ID, causing unsound bounds checks. This could allow an out-of-bounds packet access through pruned paths. The fix enforces matching range bases for packet pointers with the same ID, preserving displacement without adding per-ID state. Packet pointers without an ID are unaffected.

This vulnerability could allow the BPF verifier to incorrectly approve out-of-bounds packet accesses, potentially leading to memory safety violations within the kernel. Such violations may result in kernel crashes or other undefined behavior. No confirmed exploits in the wild are known.

A fix has been implemented in the Linux kernel to address this issue by requiring matching range bases for packet pointers sharing an ID. Users should apply the official kernel updates containing this fix when available. Patch status is not explicitly confirmed in the provided data; therefore, verify the vendor advisory for current remediation guidance.