CVE-2026-98599

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject non-negative offsets in stack_slot_obj_get_spi()

bpf_get_spi() computes (-off - 1) / BPF_REG_SIZE using C division,

which truncates toward zero. For off == 0, this produces spi 0, the

same index used by the valid stack slot at fp-8.

stack_slot_obj_get_spi() currently checks alignment and the resulting

spi bounds, but does not reject the non-negative offset itself. It can

therefore validate a PTR_TO_STACK register holding fp+0 against an

iterator stored at fp-8 even though the runtime receives the actual fp+0

pointer. An effectful iterator kfunc can then interpret memory outside

the BPF stack as iterator state.

Reject non-negative offsets before converting the offset to an spi. All

valid stack objects begin at a negative offset from the frame pointer.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References