Answer in brief
CVE-2026-98007 records a Unknown severity vulnerability in bpf: Reject non-scalar bpf_loop iteration counts. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=bb124da69c47dd98d69361ec13244ece50bec63e <656d40d1ca228ee21a9b3280432479fc9eae75ab || >=bb124da69c47dd98d69361ec13244ece50bec63e <e2e1161e03fecff6d2229a81b024337144bfcd97 || >=bb124da69c47dd98d69361ec13244ece50bec63e <f8ae8275c721334ee50fafdd986fb83294eb941a || >=bb124da69c47dd98d69361ec13244ece50bec63e <c3fd8e5fd100f122bad503bdc0e9277219533253 || bfc5c19b4b48840627af0d0f1c8f4461b276e508 || >=6.6.15 <6.7 | 656d40d1ca228ee21a9b3280432479fc9eae75ab, e2e1161e03fecff6d2229a81b024337144bfcd97, f8ae8275c721334ee50fafdd986fb83294eb941a, c3fd8e5fd100f122bad503bdc0e9277219533253, 6.7 |
| Linux/Linuxgeneric | 6.7 | Not reported |
Published upstream
Sep 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 25, 2026
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-scalar bpf_loop iteration counts bpf_loop() declares its nr_loops argument as ARG_ANYTHING. Privileged programs may pass pointer values to such arguments, so check_func_arg() lets a pointer-valued R1 reach the helper-specific checks. Since commit bb124da69c47 ("bpf: keep track of max number of bpf_loop callback iterations"), the verifier marks R1 precise and reads its upper bound to limit callback simulation. Precision backtracking only accepts scalar registers, so passing a pointer instead triggers the "backtracking misuse" verifier warning. Kernels with panic_on_warn enabled subsequently panic. Introduce ARG_SCALAR for helper arguments that only accept scalar values and use it for bpf_loop() nr_loops. Generic helper argument validation then rejects pointers before loop inlining and precision processing.
Quoted source text, attributed separately from HOL analysis.