{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337"
            },
            {
              "fixed": "3484a99303912db62428494a9061212049027e57"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "ee861486e377edc55361c08dcbceab3f6b6577bd"
            },
            {
              "fixed": "bc489c0c9b8c86bd7fac42cfd1bb152f042fca56"
            },
            {
              "fixed": "e7d28823c662128caae63f14e16bd394916c139b"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "928d354ae3557e8f755a227e67be88034eb3cd7f"
            },
            {
              "last_affected": "8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbe"
            },
            {
              "last_affected": "de1055e7f9e67af32b1f3376066272b04e5223c0"
            },
            {
              "last_affected": "37ad2bb11e9de92cb7b94548705eeedd87f7d392"
            },
            {
              "last_affected": "8674e2db06cff6b50f2216eed9a761d15425bb34"
            },
            {
              "last_affected": "d846d83bdacbd8f14fc45c63b8c1d22608452e1c"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.18.42"
            },
            {
              "fixed": "6.18.53"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "5.10.265"
            },
            {
              "fixed": "5.11"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "5.15.216"
            },
            {
              "fixed": "5.16"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.1.183"
            },
            {
              "fixed": "6.2"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.6.148"
            },
            {
              "fixed": "6.7"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.12.101"
            },
            {
              "fixed": "6.13"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "7.0.10"
            },
            {
              "fixed": "7.1"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.18.53"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98044.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject legacy packet loads from callbacks\n\ncheck_ld_abs() models a failed BPF_LD_ABS or BPF_LD_IND in a\nsubprogram as an implicit return with R0 set to zero. It calls\nprepare_func_exit() to explore this synthesized path.\n\nWhen the load is reached directly from a synchronous callback,\nprepare_func_exit() enforces the callback return contract and marks R0\nprecise. R0 is not derived from a real instruction on this path, so\nprecision backtracking reaches the callback call with R0 still requested\nand triggers the \"callback unexpected regs\" verifier bug. A privileged\nprogram loader can therefore cause a verifier warning and an -EFAULT\nBPF_PROG_LOAD.\n\nThese legacy packet-load instructions are deprecated. Reject them from\ncallbacks rather than complicating their implicit-return model. Check all\nactive frames before constructing the implicit return so nested static\nsubprograms cannot hide the callback context.\n\nGlobal functions are verified independently with a fresh frame zero, so\nan active-frame check cannot identify a global function called from a\ncallback. Also check the complete subprogram call graph during stack-depth\nvalidation and reject a function containing a legacy load when any caller\nis a callback. This covers global and static descendants without making\nhas_ld_abs transitive, preserving its per-function BTF return-type check.\nOrdinary uses outside callbacks remain supported.",
  "id": "CVE-2026-98044",
  "modified": "2026-09-27T03:30:44.342561899Z",
  "published": "2026-09-25T10:23:55.454Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3484a99303912db62428494a9061212049027e57"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bc489c0c9b8c86bd7fac42cfd1bb152f042fca56"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e7d28823c662128caae63f14e16bd394916c139b"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98044.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98044"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "bpf: Reject legacy packet loads from callbacks"
}