CVE-2026-98647

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix divide-by-zero in btf_struct_walk()

When an access goes past the struct and the last member is a flexible

array, btf_struct_walk() folds the offset back into a single element with

(off - moff) % t->size, but never checks that the element type has a size.

BTF takes an empty struct, so this in program BTF

/* event could be empty */

struct event {

#ifdef HAVE_TIMESTAMP

__u64 ts;

#endif

};

struct batch {

int nr;

struct event events[];

};

divides by zero at prog load time. Getting there needs a PTR_TO_BTF_ID that

is not MEM_ALLOC, e.g. a plain read of a local kptr stashed in a map from a

sleepable program.

Oops: divide error: 0000 [#1] SMP KASAN PTI

RIP: 0010:btf_struct_walk+0x53f/0x1570

Call Trace:

<TASK>

btf_struct_access+0x42a/0xcd0

check_ptr_to_btf_access+0x4dc/0x1160

check_mem_access+0x3a45/0x8740

check_load_mem+0x36a/0xd10

do_check_common+0x3ef0/0xb210

bpf_check+0x6d3b/0x8580

bpf_p

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References