{"id":"CVE-2026-98132","revision":"9ccae5b5a6bd4146ad04d011a004bd43","records":[{"revision":"9ccae5b5a6bd4146ad04d011a004bd43","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98132","aliases":[],"title":"bpf: don't downgrade half-dead scalar zero spills to STACK_ZERO","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: don't downgrade half-dead scalar zero spills to STACK_ZERO\n\nstates.c:__clean_func_state() can downgrade scalar zero spill to\nSTACK_ZERO in the following case:\n\n  *(u64 *)(r10 - 8) = 0;\n  ... checkpoint ...\n  r1 = *(u32 *)(r10 - 4);\n  ... no reads from r10-8 ...\n\nHere 4 bytes at r10-8 are dead and verifier changes scalar spill to a\ncombination: 0000pppp (p stands for poison). Such a change breaks\nprecision propagation chains. All places that produce STACK_ZERO\nshould call bpf_mark_chain_precision() for the zero source.\n\nThis patch fixes the bug in a simplest way possible:\navoids converting stack spills of zero to STACK_ZERO.\nTwo smarter approaches are possible:\n- do bpf_mark_chain_precision() from __clean_func_state()\n- check slot liveness information in check_stack_write_fixed_off()\n\nI investigated both and the changes required are a bit tricky,\nhence go with a simple fix for the time being.","state":0,"publishedAt":"2026-09-25T10:36:11.662+00:00","modifiedAt":"2026-10-19T09:14:26.212+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/bpf/states.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"be23266b4a08540aa43d8503a2ea10247c8daebe\",\n                            \"lessThan\": \"436fa689630b741a77ef8c4a6f426479affd5bac\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"be23266b4a08540aa43d8503a2ea10247c8daebe\",\n                            \"lessThan\": \"2f3536bff8823d3c5fdbbe15e17bfca696cc2b2e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/bpf/states.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"7.1\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.7\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/436fa689630b741a77ef8c4a6f426479affd5bac","https://git.kernel.org/stable/c/2f3536bff8823d3c5fdbbe15e17bfca696cc2b2e"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98132","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98132","identifiers":["CVE-2026-98132"]},"retained":false,"historicalAffected":[]}],"coverage":[]}