In the Linux kernel, the following vulnerability has been resolved: bpf: Restrict CO-RE poisoning to relocatable instructions CO-RE relocation… (CVE-2026-98626)

The vulnerability in the Linux kernel's BPF CO-RE relocation mechanism allowed relocation records to name any instruction offset. When a relocation could not be resolved, the function bpf_core_patch_insn() would poison the target instruction before validating if it was a valid relocation target. This flaw permitted malformed metadata to replace critical instructions like jumps, calls, exits, register-source arithmetic, or non-immediate loads, which should have failed at the relocation step. The fix ensures poisoning occurs only after the instruction passes class and operand-form checks, routing invalid forms to diagnostics and hard errors. Additionally, poisoning support was extended to both halves of ldimm64 instructions to maintain validity in dead code. These changes apply to both libbpf and in-kernel CO-RE shared relocation code.

The vulnerability could allow malformed metadata to alter critical BPF instructions improperly, potentially affecting kernel behavior or security enforcement. However, no known exploits in the wild have been reported. The fix prevents invalid instruction poisoning, reducing the risk of unintended or malicious kernel instruction manipulation via BPF CO-RE relocations.

A fix has been implemented in the Linux kernel to restrict CO-RE poisoning to valid relocatable instructions only. Users should update to the fixed kernel version once available. Since this is a kernel vulnerability, applying the official kernel update from the vendor or distribution is the recommended remediation. No additional mitigation steps are indicated.