CVE-2026-98628

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Make post-verification instruction rewrites killable

After do_check() returns, the verifier runs several instruction rewrite

passes. Some of them patch or remove one instruction at a time. Each

operation moves the remaining instruction and auxiliary-data arrays and

adjusts all branch offsets, making the overall work quadratic in the

program length.

A privileged loader can submit 131072 unconditional jumps by zero followed

by a valid return. Verification finishes quickly, but bpf_opt_remove_nops()

then spends a long time removing each jump separately. Since this

post-verification work neither checks for signals nor reschedules, a pending

SIGKILL cannot terminate the task until the rewrite finishes.

Make bpf_patch_insn_data() and verifier_remove_insns() common cancellation

and rescheduling points. These helpers run from BPF_PROG_LOAD process

context, and bpf_patch_insn_data() can already sleep while reallocating

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References