CVE-2026-98085 bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge
A flaw in the Linux kernel BPF verifier allows local attackers to cause segmentation faults or unsound state pruning, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98085?
CVE-2026-98085 is a denial of service vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge
Nicholas Carlini reported a bug in precision backtracking mechanism for BPF_LD | BPF_{IND,ABS} instructions. These instructions are modelled as two branches: - fallthrough; - implicit exit from current subprogram.
The implicit exit case was not handled by the backtrack_insn() function. When backtracking such a path backtrack_insn() did not call bt_subprog_enter(), which meant that backtracking continued manipulating precision marks in a caller frame, while looking at instructions in a callee frame.
This lead to segmentation faults during verification (see the selftest), or unsound state pruning.
Which versions are affected by CVE-2026-98085?
How do I fix CVE-2026-98085?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-98085 being exploited?
There is no known exploitation of CVE-2026-98085 in the wild and no public exploit code.
Sources
Also known as AZL-104613, BELL-CVE-2026-98085, DEBIAN-CVE-2026-98085, GHSA-7c78-fpcm-vcqr, UBUNTU-CVE-2026-98085.