Cloudanix VulnDB

CVE-2026-98628

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A privileged user can submit certain programs that make the system ignore kill requests for a long time, slowing down shutdowns and management tasks.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

A privileged BPF program loader can submit a large number of unconditional jumps that pass verification quickly but trigger lengthy non-preemptible post-verification rewrites in bpf_patch_insn_data and verifier_remove_insns, preventing SIGKILL from terminating the task until the quadratic rewrite completes.

Why it matters to the business

Privileged local users can delay or block termination of loader processes, causing prolonged CPU consumption and interfering with system management or container shutdowns in environments that rely on BPF programs.

How an attack unfolds

An attacker with CAP_BPF or equivalent privileges crafts a program containing 131072 unconditional jumps followed by a return; after do_check succeeds, bpf_opt_remove_nops runs without signal checks or rescheduling points, blocking prompt termination until the rewrite finishes.

How to fix it

Apply a kernel patch that converts bpf_patch_insn_data and verifier_remove_insns into cancellation and rescheduling points and reports -EINTR on interrupted constant blinding; upgrade to a kernel containing the fix for CVE-2026-98628.

How to confirm the fix worked

Confirm the running kernel contains the commit that adds signal checks and rescheduling to the post-verification rewrite helpers; attempt to load a test program with many jumps and verify that SIGKILL terminates the loader promptly.

Typical attack path

  1. Obtain privileges sufficient to load BPF programs
  2. Submit a BPF program consisting of many unconditional jumps followed by a valid return
  3. Allow verification to complete rapidly
  4. Trigger extended non-preemptible rewrite passes in the verifier
  5. Send SIGKILL to the loader and observe that termination is delayed until rewrite finishes

How to detect it

Inspect kernel logs and process accounting for long-running BPF_PROG_LOAD tasks; correlate high CPU time in the verifier with processes that were killed yet remained active; look for repeated bpf_opt_remove_nops activity in traces or perf data.

  • bpf_opt_remove_nops
  • bpf_patch_insn_data
  • verifier_remove_insns
  • BPF_PROG_LOAD.*unconditional jumps

What your security team should do

  • Prioritize kernel updates for systems that allow untrusted or semi-trusted BPF loading
  • Restrict BPF program loading to trusted processes via LSM or capability controls
  • Monitor for prolonged verifier activity during BPF_PROG_LOAD operations

The record

In the Linux kernel, the following vulnerability has been resolved: bpf: Make post-verification instruction rewrites killable After do_check() returns, the verifier runs several instruction rewrite passes. Some of them patch or remove one instruction at a time. Each operation moves the remaining instruction and auxiliary-data arrays and adjusts all branch offsets, making the overall work quadratic in the program length. A privileged loader can submit 131072 unconditional jumps by zero followed by a valid return. Verification finishes quickly, but bpf_opt_remove_nops() then spends a long time removing each jump separately. Since this post-verification work neither checks for signals nor reschedules, a pending SIGKILL cannot terminate the task until the rewrite finishes. Make bpf_patch_insn_data() and verifier_remove_insns() common cancellation and rescheduling points. These helpers run from BPF_PROG_LOAD process context, and bpf_patch_insn_data() can already sleep while reallocating auxiliary data. Report interrupted constant blinding as -EINTR and propagate it through both JIT paths, including kernels that permit interpreter fallback. Other blinding failures retain the existing fallback behavior. This does not reduce the quadratic cost of the rewrite passes, but it makes the work preemptible and allows a killed loader to be torn down promptly.

Affected packages

Ecosystem Package Introduced Fixed