CVE-2026-98048
Description
In the Linux kernel, the following vulnerability has been resolved: bpf: don't rewrite bpf_fastcall patterns entered by a jump mark_fastcall_pattern_for_call() must ensure that matched "spill; call; fill" instruction series is not interrupted by a jump. Otherwise the rewrite applied by bpf_remove_fastcall_spills_fills() is not sound. Record the instructions targeted by jumps in insn_aux_data[*].jump_target when the CFG is built and use this flag to stop growing a pattern at such an instruction. Jumps to the first spill are fine. Note that existing insn_aux_data[*].jmp_point field can't be reused, as it marks subprogram return instructions.
How to fix
- Linux Linuxa0cd1c3ac63504ba3c50c01a00c11812919b619f, c4d3bdb3ab211dcfad734b02e06fcb12adb4757f, 24adbc2c3bbe3385ce922587e1f8e837a68b3e25, 0b1c83dc3c4401cd7e846548f62e3caf3d06742e or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 5b5f51bff1b66cedb62b5ba74a1878341204e057 ≤ v < a0cd1c3ac63504ba3c50c01a00c11812919b619f, 5b5f51bff1b66cedb62b5ba74a1878341204e057 ≤ v < c4d3bdb3ab211dcfad734b02e06fcb12adb4757f, 5b5f51bff1b66cedb62b5ba74a1878341204e057 ≤ v < 24adbc2c3bbe3385ce922587e1f8e837a68b3e25, 5b5f51bff1b66cedb62b5ba74a1878341204e057 ≤ v < 0b1c83dc3c4401cd7e846548f62e3caf3d06742e, 6.12 | a0cd1c3ac63504ba3c50c01a00c11812919b619f, c4d3bdb3ab211dcfad734b02e06fcb12adb4757f, 24adbc2c3bbe3385ce922587e1f8e837a68b3e25, 0b1c83dc3c4401cd7e846548f62e3caf3d06742e |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.