CVE-2026-98048 bpf: don't rewrite bpf_fastcall patterns entered by a jump
A flaw in the Linux kernel's BPF verifier allows attackers to bypass jump checks, potentially leading to arbitrary code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98048?
CVE-2026-98048 is a code injection vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: don't rewrite bpf_fastcall patterns entered by a jump
mark_fastcall_pattern_for_call() must ensure that matched "spill; call; fill" instruction series is not interrupted by a jump. Otherwise the rewrite applied by bpf_remove_fastcall_spills_fills() is not sound.
Record the instructions targeted by jumps in insn_aux_data[*].jump_target when the CFG is built and use this flag to stop growing a pattern at such an instruction. Jumps to the first spill are fine.
Note that existing insn_aux_data[*].jmp_point field can't be reused, as it marks subprogram return instructions.
Which versions are affected by CVE-2026-98048?
How do I fix CVE-2026-98048?
Apply the vendor's patch.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-98048 being exploited?
There is no known exploitation of CVE-2026-98048 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-98048, DEBIAN-CVE-2026-98048, GHSA-6g34-ggc8-pv58, UBUNTU-CVE-2026-98048.