CVE-2026-98044

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject legacy packet loads from callbacks

check_ld_abs() models a failed BPF_LD_ABS or BPF_LD_IND in a

subprogram as an implicit return with R0 set to zero. It calls

prepare_func_exit() to explore this synthesized path.

When the load is reached directly from a synchronous callback,

prepare_func_exit() enforces the callback return contract and marks R0

precise. R0 is not derived from a real instruction on this path, so

precision backtracking reaches the callback call with R0 still requested

and triggers the "callback unexpected regs" verifier bug. A privileged

program loader can therefore cause a verifier warning and an -EFAULT

BPF_PROG_LOAD.

These legacy packet-load instructions are deprecated. Reject them from

callbacks rather than complicating their implicit-return model. Check all

active frames before constructing the implicit return so nested static

subprograms cannot hide the callback context.

Global fun

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References