In the Linux kernel, the following vulnerability has been resolved: bpf: Reject pkt arguments in mutating subprogs The verifier tracks changes in… (CVE-2026-98589)

The Linux kernel vulnerability (CVE-2026-98589) concerns the BPF verifier's handling of PTR_TO_PACKET registers across subprogram boundaries. PTR_TO_PACKET registers are passed as PTR_TO_MEM, assumed valid for the entire call, but packet memory can be invalidated by pskb_* calls. The verifier now rejects BPF code that passes PTR_TO_PACKET pointers to subprograms that might mutate the packet, as it cannot safely represent these pointers in subprograms without additional metadata. This prevents unsafe memory operations and potential kernel memory corruption.

This vulnerability could allow unsafe memory access or corruption within the kernel's packet processing subsystem when BPF programs pass packet pointers to mutating subprograms. This could lead to kernel instability or security issues related to memory safety. However, no known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to reject BPF code that passes PTR_TO_PACKET pointers to subprograms that may mutate packets. Users should update to the fixed kernel version once available. No additional mitigation is required beyond applying the official fix.