CVE-2026-98132

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: don't downgrade half-dead scalar zero spills to STACK_ZERO

states.c:__clean_func_state() can downgrade scalar zero spill to

STACK_ZERO in the following case:

*(u64 *)(r10 - 8) = 0;

... checkpoint ...

r1 = *(u32 *)(r10 - 4);

... no reads from r10-8 ...

Here 4 bytes at r10-8 are dead and verifier changes scalar spill to a

combination: 0000pppp (p stands for poison). Such a change breaks

precision propagation chains. All places that produce STACK_ZERO

should call bpf_mark_chain_precision() for the zero source.

This patch fixes the bug in a simplest way possible:

avoids converting stack spills of zero to STACK_ZERO.

Two smarter approaches are possible:

- do bpf_mark_chain_precision() from __clean_func_state()

- check slot liveness information in check_stack_write_fixed_off()

I investigated both and the changes required are a bit tricky,

hence go with a simple fix for the time being.

/// Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References