CVE-2026-98273

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

x86/kprobes: Fix crash when probing CS CALL instructions

When using eBPF to probe CS CALL instructions within a function,

a crash can be triggered.

The eBPF tool probes offset 257 of the __hrtimer_run_queues()

function:

<__hrtimer_run_queues+249>: nopl 0x0(%rax,%rax,1)

<__hrtimer_run_queues+254>: mov %r14,%rdi

<__hrtimer_run_queues+257>: cs call <__x86_indirect_thunk_r12>

<__hrtimer_run_queues+263>: mov %eax,%r12d

<__hrtimer_run_queues+266>: xchg %ax,%ax

<__hrtimer_run_queues+268>: mov %r13,%rdi

Which triggers this crash:

BUG: unable to handle page fault for address: 00000000000f41c9

#PF: supervisor write access in kernel mode

#PF: error_code(0x0002) - not-present page

PGD 0 P4D 0

Oops: 0002 [#1] SMP NOPTI

CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: P

RIP: 0010:__hrtimer_run_queues+0x106/0x230

Note that __hrtimer_run_queues+0x106 is __hrtimer_run_queues+262, which is

at

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References