CVE-2026-98599 bpf: Reject non-negative offsets in stack_slot_obj_get_spi()
A flaw in the Linux kernel BPF subsystem allows attackers to corrupt memory and potentially execute code by exploiting incorrect stack slot offset validation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98599?
CVE-2026-98599 is a memory corruption vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject non-negative offsets in stack_slot_obj_get_spi()
bpf_get_spi() computes (-off - 1) / BPF_REG_SIZE using C division, which truncates toward zero. For off == 0, this produces spi 0, the same index used by the valid stack slot at fp-8.
stack_slot_obj_get_spi() currently checks alignment and the resulting spi bounds, but does not reject the non-negative offset itself. It can therefore validate a PTR_TO_STACK register holding fp+0 against an iterator stored at fp-8 even though the runtime receives the actual fp+0 pointer. An effectful iterator kfunc can then interpret memory outside the BPF stack as iterator state.
Reject non-negative offsets before converting the offset to an spi. All valid stack objects begin at a negative offset from the frame pointer.
Which versions are affected by CVE-2026-98599?
How do I fix CVE-2026-98599?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-98599 being exploited?
There is no known exploitation of CVE-2026-98599 in the wild and no public exploit code.
Sources
Also known as AZL-109412, BELL-CVE-2026-98599, DEBIAN-CVE-2026-98599, GHSA-6688-ppfm-xwh9, UBUNTU-CVE-2026-98599.