CVE-2026-98075

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: reject BPF_PSEUDO_FUNC reference to the main program

fixups.c:jit_subprogs() rewrites BPF_PSEUDO_FUNC loads to contain real

function addresses. This function is invoked from bpf_jit_subprogs()

only when env->subprog_cnt > 1. Meaning that for any program like

below:

int main(void *ctx) {

void *ptr = main;

...

bpf_timer_set_callback(..., ptr);

...

}

The 'ptr' won't be ever converted to contain an address.

In combination with e.g. bpf_timer_set_callback() this would lead to a

function call at a bogus address.

Instead of complicating the implementation, just assume that no useful

program needs main to be a sync or async callback and reject

BPF_PSEUDO_FUNC loads for the main subprogram.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References