CVE-2026-98007 bpf: Reject non-scalar bpf_loop iteration counts
Privileged BPF programs can trigger a kernel panic by passing pointer values to bpf_loop, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98007?
CVE-2026-98007 is a denial of service vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject non-scalar bpf_loop iteration counts
bpf_loop() declares its nr_loops argument as ARG_ANYTHING. Privileged programs may pass pointer values to such arguments, so check_func_arg() lets a pointer-valued R1 reach the helper-specific checks.
Since commit bb124da69c47 ("bpf: keep track of max number of bpf_loop callback iterations"), the verifier marks R1 precise and reads its upper bound to limit callback simulation. Precision backtracking only accepts scalar registers, so passing a pointer instead triggers the "backtracking misuse" verifier warning. Kernels with panic_on_warn enabled subsequently panic.
Introduce ARG_SCALAR for helper arguments that only accept scalar values and use it for bpf_loop() nr_loops. Generic helper argument validation then rejects pointers before loop inlining and precision processing.
Which versions are affected by CVE-2026-98007?
How do I fix CVE-2026-98007?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-98007 being exploited?
There is no known exploitation of CVE-2026-98007 in the wild and no public exploit code.
Sources
Also known as AZL-104697, BELL-CVE-2026-98007, DEBIAN-CVE-2026-98007, GHSA-mrrf-4w4m-vf8m, UBUNTU-CVE-2026-98007.