CVE-2026-98075
CVE CVE-2026-98075EUVD EUVD-2026-86905Published 2026-09-25T10:24:14.000Z
What the advisory describes
In the Linux kernel, the following vulnerability has been resolved: bpf: reject BPF_PSEUDO_FUNC reference to the main program fixups.c:jit_subprogs() rewrites BPF_PSEUDO_FUNC loads to contain real function addresses. This function is invoked from bpf_jit_subprogs() only when env->subprog_cnt > 1. Meaning that for any program like below: int main(void *ctx) { void *ptr = main; ... bpf_timer_set_callback(..., ptr); ... } The 'ptr' won't be ever converted to contain an address. In combination with e.g. bpf_timer_set_callback() this would lead to a function call at a bogus address. Instead of complicating the implementation, just assume that no useful program needs main to be a sync or async callback and reject BPF_PSEUDO_FUNC loads for the main subprogram.
Source: EUVD (ENISA), in the words of the advisory.
Products the advisory names
These come from the advisory itself, not from any check we performed.
- Linux — Linux 69c087ba6225b574afb6e505b72cb75242a3d844 <92f0bd0e2b632c6565ac2214a4d7d2ed37e5b9f6; patch: 7.3-rc2; patch: 6.12.111; 69c087ba6225b574afb6e505b72cb75242a3d844 <d6c39774ae093c9f7009cc4ae918f18fc1af7ae7; 69c087ba6225b574afb6e505b72cb75242a3d844 <118212417ba0120d99f84154799f8880f07411f4; 5.13; patch: 0; 69c087ba6225b574afb6e505b72cb75242a3d844 <374b2c5561db80fcdd7cdce44af37a49416f61c7; patch: 6.18.53; patch: 7.2.7
The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.
Carried in the product catalogue
An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.
- Linux — Linux
Does this concern one of your customers?
This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.
Try it for 28 daysPatchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.