{"api_version":"1","generated_at":"2026-10-26T09:28:10+00:00","cve":"CVE-2026-98628","urls":{"html":"https://cve.report/CVE-2026-98628","api":"https://cve.report/api/cve/CVE-2026-98628.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-98628","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-98628"},"summary":{"title":"bpf: Make post-verification instruction rewrites killable","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Make post-verification instruction rewrites killable\n\nAfter do_check() returns, the verifier runs several instruction rewrite\npasses. Some of them patch or remove one instruction at a time. Each\noperation moves the remaining instruction and auxiliary-data arrays and\nadjusts all branch offsets, making the overall work quadratic in the\nprogram length.\n\nA privileged loader can submit 131072 unconditional jumps by zero followed\nby a valid return. Verification finishes quickly, but bpf_opt_remove_nops()\nthen spends a long time removing each jump separately. Since this\npost-verification work neither checks for signals nor reschedules, a pending\nSIGKILL cannot terminate the task until the rewrite finishes.\n\nMake bpf_patch_insn_data() and verifier_remove_insns() common cancellation\nand rescheduling points. These helpers run from BPF_PROG_LOAD process\ncontext, and bpf_patch_insn_data() can already sleep while reallocating\nauxiliary data.\n\nReport interrupted constant blinding as -EINTR and propagate it through\nboth JIT paths, including kernels that permit interpreter fallback.\nOther blinding failures retain the existing fallback behavior.\n\nThis does not reduce the quadratic cost of the rewrite passes, but it makes\nthe work preemptible and allows a killed loader to be torn down promptly.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-10-18 16:17:15","updated_at":"2026-10-19 10:19:27"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/56dc616d7a1f7d134d3e101c455e62b0a24d0cfd","name":"https://git.kernel.org/stable/c/56dc616d7a1f7d134d3e101c455e62b0a24d0cfd","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/261b61d3735b042ae25634f795c4540be0fc140c","name":"https://git.kernel.org/stable/c/261b61d3735b042ae25634f795c4540be0fc140c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98628","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98628","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 52875a04f4b26e7ef30a288ea096f7cfec0e93cd 56dc616d7a1f7d134d3e101c455e62b0a24d0cfd git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 52875a04f4b26e7ef30a288ea096f7cfec0e93cd 261b61d3735b042ae25634f795c4540be0fc140c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.1","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.1 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.9 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/bpf/core.c","kernel/bpf/fixups.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"56dc616d7a1f7d134d3e101c455e62b0a24d0cfd","status":"affected","version":"52875a04f4b26e7ef30a288ea096f7cfec0e93cd","versionType":"git"},{"lessThan":"261b61d3735b042ae25634f795c4540be0fc140c","status":"affected","version":"52875a04f4b26e7ef30a288ea096f7cfec0e93cd","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/bpf/core.c","kernel/bpf/fixups.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.1"},{"lessThan":"5.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.9","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.9","versionStartIncluding":"5.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3","versionStartIncluding":"5.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Make post-verification instruction rewrites killable\n\nAfter do_check() returns, the verifier runs several instruction rewrite\npasses. Some of them patch or remove one instruction at a time. Each\noperation moves the remaining instruction and auxiliary-data arrays and\nadjusts all branch offsets, making the overall work quadratic in the\nprogram length.\n\nA privileged loader can submit 131072 unconditional jumps by zero followed\nby a valid return. Verification finishes quickly, but bpf_opt_remove_nops()\nthen spends a long time removing each jump separately. Since this\npost-verification work neither checks for signals nor reschedules, a pending\nSIGKILL cannot terminate the task until the rewrite finishes.\n\nMake bpf_patch_insn_data() and verifier_remove_insns() common cancellation\nand rescheduling points. These helpers run from BPF_PROG_LOAD process\ncontext, and bpf_patch_insn_data() can already sleep while reallocating\nauxiliary data.\n\nReport interrupted constant blinding as -EINTR and propagate it through\nboth JIT paths, including kernels that permit interpreter fallback.\nOther blinding failures retain the existing fallback behavior.\n\nThis does not reduce the quadratic cost of the rewrite passes, but it makes\nthe work preemptible and allows a killed loader to be torn down promptly."}],"providerMetadata":{"dateUpdated":"2026-10-19T09:22:56.237Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/56dc616d7a1f7d134d3e101c455e62b0a24d0cfd"},{"url":"https://git.kernel.org/stable/c/261b61d3735b042ae25634f795c4540be0fc140c"}],"title":"bpf: Make post-verification instruction rewrites killable","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-98628","datePublished":"2026-10-18T15:19:49.746Z","dateReserved":"2026-09-25T10:25:14.361Z","dateUpdated":"2026-10-19T09:22:56.237Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-18 16:17:15","lastModifiedDate":"2026-10-19 10:19:27","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"98628","Ordinal":"1","Title":"bpf: Make post-verification instruction rewrites killable","CVE":"CVE-2026-98628","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"98628","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Make post-verification instruction rewrites killable\n\nAfter do_check() returns, the verifier runs several instruction rewrite\npasses. Some of them patch or remove one instruction at a time. Each\noperation moves the remaining instruction and auxiliary-data arrays and\nadjusts all branch offsets, making the overall work quadratic in the\nprogram length.\n\nA privileged loader can submit 131072 unconditional jumps by zero followed\nby a valid return. Verification finishes quickly, but bpf_opt_remove_nops()\nthen spends a long time removing each jump separately. Since this\npost-verification work neither checks for signals nor reschedules, a pending\nSIGKILL cannot terminate the task until the rewrite finishes.\n\nMake bpf_patch_insn_data() and verifier_remove_insns() common cancellation\nand rescheduling points. These helpers run from BPF_PROG_LOAD process\ncontext, and bpf_patch_insn_data() can already sleep while reallocating\nauxiliary data.\n\nReport interrupted constant blinding as -EINTR and propagate it through\nboth JIT paths, including kernels that permit interpreter fallback.\nOther blinding failures retain the existing fallback behavior.\n\nThis does not reduce the quadratic cost of the rewrite passes, but it makes\nthe work preemptible and allows a killed loader to be torn down promptly.","Type":"Description","Title":"bpf: Make post-verification instruction rewrites killable"}]}}}