CVE-2026-98007

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject non-scalar bpf_loop iteration counts

bpf_loop() declares its nr_loops argument as ARG_ANYTHING. Privileged

programs may pass pointer values to such arguments, so check_func_arg()

lets a pointer-valued R1 reach the helper-specific checks.

Since commit bb124da69c47 ("bpf: keep track of max number of bpf_loop

callback iterations"), the verifier marks R1 precise and reads its upper

bound to limit callback simulation. Precision backtracking only accepts

scalar registers, so passing a pointer instead triggers the "backtracking

misuse" verifier warning. Kernels with panic_on_warn enabled subsequently

panic.

Introduce ARG_SCALAR for helper arguments that only accept scalar values

and use it for bpf_loop() nr_loops. Generic helper argument validation then

rejects pointers before loop inlining and precision processing.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References