CVE-2026-98061

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject tail calls directly from callback frames

A tail call from a non-zero frame is modeled as a return from that frame.

The verifier makes R0 unknown and calls prepare_func_exit() for the taken

branch.

When the current frame is a synchronous callback, prepare_func_exit()

enforces the callback return-value contract and marks R0 precise. Since the

tail-call path synthesized R0 rather than deriving it from an instruction,

precision backtracking reaches the callback-calling instruction with R0

still requested and triggers the "callback unexpected regs" verifier bug.

A CAP_BPF task can therefore cause a WARN and an -EFAULT BPF_PROG_LOAD.

Tail calls reachable from callbacks are already rejected later by

check_max_stack_depth(). Reject a tail call made directly by a callback

before constructing the inconsistent return state, using the existing

diagnostic. Tail calls from ordinary subprograms keep their current

beha

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References