CVE-2026-98613

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Bound ownership depth through local kptrs and graph roots

Program-allocated objects can own other local objects through referenced

kptrs. bpf_obj_free_fields() follows those pointers through

__bpf_obj_drop_impl() synchronously, before the object storage is freed

through RCU. A self-referential local kptr type therefore permits arbitrarily

deep object chains, and dropping the head can exhaust the kernel stack.

Long acyclic type chains have the same problem.

btf_check_and_fixup_fields() still assumes referenced kptrs only point to

kernel types and checks ownership through list and rbtree roots only. Its

existing rule is sufficient for graph-only cycles: the target of each graph

edge must contain a node, so every type in a cycle has both a root and a

node. The rule rejects such a type owning another root, breaking every

cycle. It also limits graph-only chains to three types, or two if the first

type contains a nod

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References