Cloudanix VulnDB

CVE-2026-98613

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel could let specially crafted programs crash the whole system by creating data structures that are too deeply nested.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

A flaw in BPF type checking allowed self-referential local kptrs and long acyclic chains, enabling arbitrarily deep object ownership graphs that cause stack exhaustion during synchronous object freeing in bpf_obj_free_fields().

Why it matters to the business

Linux systems running untrusted or complex BPF programs may experience kernel stack overflows leading to crashes or denial of service, with broad impact on any environment using modern eBPF workloads.

How an attack unfolds

An attacker crafts a BPF program containing self-referential local kptr types or excessively long type chains. Upon program termination or object drop, the recursive freeing in __bpf_obj_drop_impl traverses the deep chain, exhausting the kernel stack before RCU freeing completes.

How to fix it

Update to a patched Linux kernel that implements a bounded ownership walk in btf_check_and_fixup_fields() limiting depth to eight record-bearing types for both graph roots and local referenced kptrs.

How to confirm the fix worked

Verify kernel BTF loading rejects programs with ownership depth exceeding eight types; confirm updated BTF validation tests pass for allowed longer acyclic graph layouts.

Typical attack path

  1. Craft malicious BPF program with deep or cyclic local kptr ownership
  2. Load the program into the kernel via bpf() syscall
  3. Trigger object allocation and subsequent free operations through map operations or program exit
  4. Cause stack overflow during recursive bpf_obj_free_fields execution

How to detect it

Examine kernel logs and dmesg for stack overflow panics or warnings originating from bpf_obj_free_fields or __bpf_obj_drop_impl following BPF program loads.

What your security team should do

  • Apply the latest mainline or distribution kernel updates containing the bounded ownership check
  • Restrict unprivileged BPF program loading via sysctl or LSM policies where possible
  • Monitor kernel logs for BPF-related stack overflow or panic events

The record

In the Linux kernel, the following vulnerability has been resolved: bpf: Bound ownership depth through local kptrs and graph roots Program-allocated objects can own other local objects through referenced kptrs. bpf_obj_free_fields() follows those pointers through __bpf_obj_drop_impl() synchronously, before the object storage is freed through RCU. A self-referential local kptr type therefore permits arbitrarily deep object chains, and dropping the head can exhaust the kernel stack. Long acyclic type chains have the same problem. btf_check_and_fixup_fields() still assumes referenced kptrs only point to kernel types and checks ownership through list and rbtree roots only. Its existing rule is sufficient for graph-only cycles: the target of each graph edge must contain a node, so every type in a cycle has both a root and a node. The rule rejects such a type owning another root, breaking every cycle. It also limits graph-only chains to three types, or two if the first type contains a node, and conservatively rejects longer acyclic chains. The missing local-kptr edges, rather than a missed graph-only cycle, are the bug introduced by support for bpf_kptr_xchg() into local kptrs. Replace that restriction with one bounded ownership walk covering graph roots and local referenced kptrs. Run it after all BTF records have been fixed up, reject cycles and paths deeper than eight record-bearing types, and cache each type's suffix depth while checking it against the remaining budget. This also permits the longer acyclic graph-only layouts rejected by the old rule; update their existing BTF tests accordingly. Keep the bound independent of MAX_CALL_FRAMES because recursive destruction can run below a BPF call chain. A plain local pointee without special-field metadata adds only a final non-recursing drop. Non-owning kptrs and kernel-BTF kptrs do not recurse through local records and remain outside the walk. Include local percpu-kptr edges too, although allocation of percpu objects with special fields is currently forbidden, so that relaxing that restriction cannot bypass the ownership bound. btf_check_and_fixup_fields() continues to initialize graph_root.value_rec, including for separately allocated map records. The ownership relationships belong to immutable program BTF and only need validation at BTF load time.

Affected packages

Ecosystem Package Introduced Fixed