Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-scalar bpf_loop iteration counts bpf_loop() declares its nr_loops argument as ARG_ANYTHING. Privileged programs may pass pointer values to such arguments, so check_func_arg() lets a pointer-valued R1 reach the helper-specific checks. Since commit bb124da69c47 ("bpf: keep track of max number of bpf_loop callback iterations"), the verifier marks R1 precise and reads its upper bound to limit callback simulation. Precision backtracking only accepts scalar registers, so passing a pointer instead triggers the "backtracking misuse" verifier warning. Kernels with panic_on_warn enabled subsequently panic. Introduce ARG_SCALAR for helper arguments that only accept scalar values and use it for bpf_loop() nr_loops. Generic helper argument validation then rejects pointers before loop inlining and precision processing.
References
- https://git.kernel.org/stable/c/2ff38b3552af53238aee6c877ae64cc798d46fce
- https://git.kernel.org/stable/c/656d40d1ca228ee21a9b3280432479fc9eae75ab
- https://git.kernel.org/stable/c/c3fd8e5fd100f122bad503bdc0e9277219533253
- https://git.kernel.org/stable/c/e2e1161e03fecff6d2229a81b024337144bfcd97
- https://git.kernel.org/stable/c/f8ae8275c721334ee50fafdd986fb83294eb941a
FAQ
What is CVE-2026-98007?
CVE-2026-98007 is a documented vulnerability. In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-scalar bpf_loop iteration counts bpf_loop() declares its nr_loops argument as ARG_ANYTHING. Privileged programs ma...
How severe is CVE-2026-98007?
CVSS scoring is not yet available for CVE-2026-98007. Check NVD for updates.
Is there a patch for CVE-2026-98007?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.