{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "be23266b4a08540aa43d8503a2ea10247c8daebe"
            },
            {
              "fixed": "436fa689630b741a77ef8c4a6f426479affd5bac"
            },
            {
              "fixed": "2f3536bff8823d3c5fdbbe15e17bfca696cc2b2e"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.1.0"
            },
            {
              "fixed": "7.2.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98132.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: don't downgrade half-dead scalar zero spills to STACK_ZERO\n\nstates.c:__clean_func_state() can downgrade scalar zero spill to\nSTACK_ZERO in the following case:\n\n  *(u64 *)(r10 - 8) = 0;\n  ... checkpoint ...\n  r1 = *(u32 *)(r10 - 4);\n  ... no reads from r10-8 ...\n\nHere 4 bytes at r10-8 are dead and verifier changes scalar spill to a\ncombination: 0000pppp (p stands for poison). Such a change breaks\nprecision propagation chains. All places that produce STACK_ZERO\nshould call bpf_mark_chain_precision() for the zero source.\n\nThis patch fixes the bug in a simplest way possible:\navoids converting stack spills of zero to STACK_ZERO.\nTwo smarter approaches are possible:\n- do bpf_mark_chain_precision() from __clean_func_state()\n- check slot liveness information in check_stack_write_fixed_off()\n\nI investigated both and the changes required are a bit tricky,\nhence go with a simple fix for the time being.",
  "id": "CVE-2026-98132",
  "modified": "2026-09-27T03:30:51.283238306Z",
  "published": "2026-09-25T10:36:11.662Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2f3536bff8823d3c5fdbbe15e17bfca696cc2b2e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/436fa689630b741a77ef8c4a6f426479affd5bac"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98132.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98132"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "bpf: don't downgrade half-dead scalar zero spills to STACK_ZERO"
}