In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-negative offsets in stack_slot_obj_get_spi() bpf_get_spi()… (CVE-2026-98599)

The Linux kernel BPF subsystem had a vulnerability where bpf_get_spi() computed stack pointer indices using C division that truncates toward zero, causing off == 0 to produce spi 0, overlapping with a valid stack slot at fp-8. The function stack_slot_obj_get_spi() checked alignment and bounds but did not reject non-negative offsets, allowing a PTR_TO_STACK register holding fp+0 to be validated against an iterator stored at fp-8. This mismatch could let an effectful iterator kernel function interpret memory outside the BPF stack as iterator state. The fix involves rejecting non-negative offsets before converting them to stack pointer indices, ensuring all valid stack objects start at negative offsets from the frame pointer.

This vulnerability could allow kernel BPF programs to misinterpret memory outside the intended BPF stack region, potentially leading to incorrect program behavior or memory corruption within the kernel. However, no known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to reject non-negative offsets in stack_slot_obj_get_spi(). Users should update to the fixed kernel version once available. Patch status is not yet confirmed; check the vendor advisory for current remediation guidance.