CVE-2026-98085

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge

Nicholas Carlini reported a bug in precision backtracking mechanism

for BPF_LD | BPF_{IND,ABS} instructions. These instructions are

modelled as two branches:

- fallthrough;

- implicit exit from current subprogram.

The implicit exit case was not handled by the backtrack_insn()

function. When backtracking such a path backtrack_insn() did not

call bt_subprog_enter(), which meant that backtracking continued

manipulating precision marks in a caller frame, while looking at

instructions in a callee frame.

This lead to segmentation faults during verification (see the

selftest), or unsound state pruning.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References