CVE-2026-80607 tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg
A local attacker can trigger a kernel warning and potential denial of service by adding a kprobe event with a raw address and BTF parameter.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80607?
CVE-2026-80607 is a denial of service vulnerability in Linux, published on 28 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg
Sashiko found that user can cause this WARN_ON_ONCE() easily with adding a kprobe event based on a raw address with BTF parameter.
Since this is not an unexpected condition, remove the WARN_ON_ONCE().
Which versions are affected by CVE-2026-80607?
How do I fix CVE-2026-80607?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-80607 being exploited?
There is no known exploitation of CVE-2026-80607 in the wild and no public exploit code.
Sources
Also known as AZL-98048, BELL-CVE-2026-80607, DEBIAN-CVE-2026-80607, GHSA-x9r4-5m29-32qp, UBUNTU-CVE-2026-80607.