CVE-2026-98599
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-negative offsets in stack_slot_obj_get_spi() bpf_get_spi() computes (-off - 1) / BPF_REG_SIZE using C division, which truncates toward zero. For off == 0, this produces spi 0, the same index used by the valid stack slot at fp-8. stack_slot_obj_get_spi() currently checks alignment and the resulting spi bounds, but does not reject the non-negative offset itself. It can therefore validate a PTR_TO_STACK register holding fp+0 against an iterator stored at fp-8 even though the runtime receives the actual fp+0 pointer. An effectful iterator kfunc can then interpret memory outside the BPF stack as iterator state. Reject non-negative offsets before converting the offset to an spi. All valid stack objects begin at a negative offset from the frame pointer.
Affected versions
Linux kernel versions
6.4
and later are affected. Fixed in
7.2.9,
7.3
and their respective stable series.
References
2 totalFrequently asked questions
-
What is CVE-2026-98599?
CVE-2026-98599 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.4 onward and has been patched in 7.2.9 and 7.3. CVE-2026-98599 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98599?
Yes. CVE-2026-98599 has been patched. Fixed versions include 7.2.9 and 7.3. If you are running Linux kernel 6.4 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98599 actively exploited?
No. CVE-2026-98599 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.