CVE-2026-98611

What it actually does

Out-of-bounds kernel memory read in bpf_crypto_ctx_create kfunc when a BPF program supplies a params buffer smaller than struct bpf_crypto_params; reserved fields at offsets 14-15 are accessed before the __sz-validated length is checked.

Why it matters to the business

Low-probability information disclosure or kernel stability issues on Linux systems that load untrusted BPF programs using the crypto kfunc; recent disclosure and stable low EPSS indicate limited immediate operational risk.

How an attack unfolds

An attacker authors a BPF program that invokes bpf_crypto_ctx_create with a deliberately undersized params buffer, bypassing the verifier's size guarantee and causing the kernel to read reserved fields from memory beyond the supplied buffer.

How to fix it

Apply the upstream kernel patch that relocates the params__sz check before any access to the reserved fields; rebuild and deploy the fixed kernel across all affected Linux distributions.

How to confirm the fix worked

Confirm the source change that performs the size validation prior to reading reserved fields; run existing BPF selftests for crypto kfuncs and verify no out-of-bounds accesses occur with short buffers.

Typical attack path

1. Compile and load a BPF program containing a call to bpf_crypto_ctx_create
2. Pass a params buffer whose length is less than sizeof(struct bpf_crypto_params)
3. Trigger the kfunc so the kernel reads params->reserved[0] and [1] before the size comparison
4. Observe or exfiltrate kernel memory contents returned or side-channeled by the out-of-bounds read

How to detect it

Review kernel audit logs and BPF event traces for unusual bpf_crypto_ctx_create calls or verifier warnings around parameter size; correlate with process execution of bpftool or custom loaders.

What your security team should do

• Patch Linux kernels to the fixed version as soon as vendor packages are available
• Restrict unprivileged BPF program loading via sysctl or LSM policy until patches are deployed
• Monitor EPSS and KEV updates for any change in exploit maturity