Cloudanix VulnDB

CVE-2026-98599

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A recent Linux kernel bug could let certain low-level programs read or change memory they are not supposed to reach, which might allow an attacker to interfere with the system.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Medium

What it actually does

The BPF verifier fails to reject non-negative offsets in stack_slot_obj_get_spi(), allowing a PTR_TO_STACK at fp+0 to be treated as valid for an iterator stored at fp-8; effectful iterator kfuncs can then operate on memory outside the BPF stack frame.

Why it matters to the business

Systems running untrusted or user-supplied BPF programs on vulnerable kernels face elevated risk of memory corruption or privilege escalation; the flaw is five days old with stable low exploit probability and no known campaigns.

How an attack unfolds

An attacker loads a crafted BPF program that constructs a stack pointer at offset zero, passes it to an effectful iterator kfunc, and relies on the verifier accepting the invalid mapping so that the kfunc interprets arbitrary kernel memory as iterator state.

How to fix it

Upgrade the Linux kernel to a release containing the commit that rejects non-negative offsets before the spi conversion in stack_slot_obj_get_spi().

How to confirm the fix worked

Inspect the kernel source or running binary for the added early return that rejects off >= 0 in stack_slot_obj_get_spi(); confirm BPF verifier unit tests cover the fp+0 case.

Typical attack path

  1. Compile and load a BPF program containing a non-negative stack offset
  2. Register the pointer with a kfunc expecting a stack-allocated iterator
  3. Trigger the kfunc to perform reads or writes based on the misinterpreted memory
  4. Escalate via the resulting out-of-bounds access or corrupt kernel structures

How to detect it

Monitor kernel logs for BPF verifier warnings around stack slot calculations, audit unusual bpf() syscall patterns from untrusted processes, and inspect loaded BPF programs for non-negative stack offsets via bpftool or similar tooling.

What your security team should do

  • Prioritize kernel updates on any host that permits unprivileged BPF loading
  • Temporarily set kernel.unprivileged_bpf_disabled=1 where workload permits
  • Review and tighten BPF program signing or loading policies
  • Reassess in 30 days if EPSS or exploit maturity increases

The record

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-negative offsets in stack_slot_obj_get_spi() bpf_get_spi() computes (-off - 1) / BPF_REG_SIZE using C division, which truncates toward zero. For off == 0, this produces spi 0, the same index used by the valid stack slot at fp-8. stack_slot_obj_get_spi() currently checks alignment and the resulting spi bounds, but does not reject the non-negative offset itself. It can therefore validate a PTR_TO_STACK register holding fp+0 against an iterator stored at fp-8 even though the runtime receives the actual fp+0 pointer. An effectful iterator kfunc can then interpret memory outside the BPF stack as iterator state. Reject non-negative offsets before converting the offset to an spi. All valid stack objects begin at a negative offset from the frame pointer.

Affected packages

Ecosystem Package Introduced Fixed