CVE-2026-98626 bpf: Restrict CO-RE poisoning to relocatable instructions
A local attacker can exploit improper CO-RE relocation handling in the Linux kernel to inject malicious code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98626?
CVE-2026-98626 is a code injection vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Restrict CO-RE poisoning to relocatable instructions
CO-RE relocation records can name any instruction offset. When a relocation cannot be resolved, bpf_core_patch_insn() currently poisons its target before checking whether that instruction is a valid relocation target. Malformed metadata can therefore replace jumps, calls, exits, register-source arithmetic, or non-immediate loads instead of failing at the relocation step.
Handle poisoning only after the instruction has passed the same class and operand-form checks used for a resolved relocation. Route invalid forms through the existing diagnostic and return a hard error. Keep poisoning supported instructions, including both halves of a plain ldimm64, so an unresolved relocation in dead code remains valid.
Extend bpf_core_poison_insn() to poison both halves of ldimm64, and return its status directly from each validated instruction case. This avoids routing the success path through a common label and leaves the helper free to report errors.
The shared relocation code applies this restriction to both libbpf and in-kernel CO-RE.
Which versions are affected by CVE-2026-98626?
How do I fix CVE-2026-98626?
Apply the vendor's patch.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-98626 being exploited?
There is no known exploitation of CVE-2026-98626 in the wild and no public exploit code.
Sources
Also known as AZL-108947, BELL-CVE-2026-98626, DEBIAN-CVE-2026-98626, GHSA-7qcx-cmxq-wh7w, UBUNTU-CVE-2026-98626.