{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.190-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.113-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.9-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  bpf: Fix divide-by-zero in btf_struct_walk()  When an access goes past the struct and the last member is a flexible array, btf_struct_walk() folds the offset back into a single element with (off - moff) % t-\u003esize, but never checks that the element type has a size.  BTF takes an empty struct, so this in program BTF  \t/* event could be empty */ \tstruct event {  #ifdef HAVE_TIMESTAMP \t\t__u64 ts;  #endif \t};  \tstruct batch { \t\tint nr; \t\tstruct event events[]; \t};  divides by zero at prog load time. Getting there needs a PTR_TO_BTF_ID that is not MEM_ALLOC, e.g. a plain read of a local kptr stashed in a map from a sleepable program.  Oops: divide error: 0000 [#1] SMP KASAN PTI RIP: 0010:btf_struct_walk+0x53f/0x1570 Call Trace:  \u003cTASK\u003e  btf_struct_access+0x42a/0xcd0  check_ptr_to_btf_access+0x4dc/0x1160  check_mem_access+0x3a45/0x8740  check_load_mem+0x36a/0xd10  do_check_common+0x3ef0/0xb210  bpf_check+0x6d3b/0x8580  bpf_prog_load+0xf7c/0x2720  __sys_bpf+0xa83/0x3690  __x64_sys_bpf+0xc7/0x150  x64_sys_call+0x1f3f/0x27e0  do_syscall_64+0xe5/0x610  entry_SYSCALL_64_after_hwframe+0x76/0x7e  \u003c/TASK\u003e  Reject a zero-sized element type. The fixed array path in the same function already bails out on the same thing:  \tbtf_struct_walk() \t... \t\t/* skip empty array */ \t\tif (moff == mtrue_end) \t\t\tcontinue;  \t\tmsize /= total_nelems;",
  "id": "DEBIAN-CVE-2026-98647",
  "modified": "2026-10-19T04:47:33.553387376Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-98647"
    }
  ],
  "upstream": [
    "CVE-2026-98647"
  ]
}