Description
In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject non-negative offsets in stack_slot_obj_get_spi()

bpf_get_spi() computes (-off - 1) / BPF_REG_SIZE using C division,
which truncates toward zero. For off == 0, this produces spi 0, the
same index used by the valid stack slot at fp-8.

stack_slot_obj_get_spi() currently checks alignment and the resulting
spi bounds, but does not reject the non-negative offset itself. It can
therefore validate a PTR_TO_STACK register holding fp+0 against an
iterator stored at fp-8 even though the runtime receives the actual fp+0
pointer. An effectful iterator kfunc can then interpret memory outside
the BPF stack as iterator state.

Reject non-negative offsets before converting the offset to an spi. All
valid stack objects begin at a negative offset from the frame pointer.
Published: 2026-10-18
Score: 6.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Kernel BPF out-of-bounds memory read
Action: Apply patch
AI Analysis

Impact

The vulnerability arises in the Linux kernel BPF subsystem, where stack_slot_obj_get_spi() fails to reject non-negative stack offsets before converting them into a stack pointer index. This oversight allows a BPF iterator to validate a register holding a pointer to the frame pointer (fp+0) against an iterator stored at fp-8. Consequently, an effectful iterator function can interpret memory outside the intended BPF stack range as iterator state. The result is a kernel-space out-of-bounds read that may expose kernel memory contents or cause a crash.

Affected Systems

This flaw affects all versions of the Linux kernel that include the erroneous stack_slot_obj_get_spi() logic referenced in the patches 79a9172f3ab4ad8392c5e5c8944b9b7710ade620 and 89a7241fc7ecc1b5e47c3f071081e314523b8d9d. Specific affected releases are not enumerated; any kernel lacking these commits is vulnerable.

Risk and Exploitability

The CVSS score is 6.7 and the EPSS score is < 1%, indicating a moderate severity and low probability of exploitation. The flaw enables a kernel-space memory read that can leak sensitive information, and it is not currently listed in CISA’s KEV catalog.

Generated by OpenCVE AI on October 20, 2026 at 17:08 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the kernel to a version that includes the patches identifying non-negative offsets as invalid in stack_slot_obj_get_spi()
  • Ensure the system uses the latest stable kernel release that contains commit 79a9172f3ab4ad8392c5e5c8944b9b7710ade620 or 89a7241fc7ecc1b5e47c3f071081e314523b8d9d
  • If an immediate kernel update is not possible, limit the loading of BPF programs to trusted users by setting the appropriate policy or disabling the BPF syscall via sysctl or kernel configuration (e.g., CONFIG_BPF_SYSCALL=y)

Generated by OpenCVE AI on October 20, 2026 at 17:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1285
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate

Sun, 18 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125
CWE-129

Sun, 18 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-negative offsets in stack_slot_obj_get_spi() bpf_get_spi() computes (-off - 1) / BPF_REG_SIZE using C division, which truncates toward zero. For off == 0, this produces spi 0, the same index used by the valid stack slot at fp-8. stack_slot_obj_get_spi() currently checks alignment and the resulting spi bounds, but does not reject the non-negative offset itself. It can therefore validate a PTR_TO_STACK register holding fp+0 against an iterator stored at fp-8 even though the runtime receives the actual fp+0 pointer. An effectful iterator kfunc can then interpret memory outside the BPF stack as iterator state. Reject non-negative offsets before converting the offset to an spi. All valid stack objects begin at a negative offset from the frame pointer.
Title bpf: Reject non-negative offsets in stack_slot_obj_get_spi()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-19T09:22:25.359Z

Reserved: 2026-09-25T10:25:14.359Z

Link: CVE-2026-98599

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:12.603

Modified: 2026-10-19T10:19:21.383

Link: CVE-2026-98599

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98599 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T17:15:14Z

Weaknesses
  • CWE-125

    Out-of-bounds Read

  • CWE-1285

    Improper Validation of Specified Index, Position, or Offset in Input

  • CWE-129

    Improper Validation of Array Index