{"id":"CVE-2026-98628","title":"bpf: Make post-verification instruction rewrites killable","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Make post-verification instruction rewrites killable\n\nAfter do_check() returns, the verifier runs several instruction rewrite\npasses. Some of them patch or remove …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 52875a04f4b26e7ef30a288ea096f7cfec0e93cd < 56dc616d7a1f7d134d3e101c455e62b0a24d0cfd","Linux >= 52875a04f4b26e7ef30a288ea096f7cfec0e93cd < 261b61d3735b042ae25634f795c4540be0fc140c","Linux 5.1"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T15:19:49.746Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98628","references":[{"url":"https://git.kernel.org/stable/c/56dc616d7a1f7d134d3e101c455e62b0a24d0cfd"},{"url":"https://git.kernel.org/stable/c/261b61d3735b042ae25634f795c4540be0fc140c"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T15:45:12.235Z","slug":"CVE-2026-98628","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Make post-verification instruction rewrites killable\n\nAfter do_check() returns, the verifier runs several instruction rewrite\npasses. Some of them patch or remove one instruction at a time. Each\noperation moves the remaining instruction and auxiliary-data arrays and\nadjusts all branch offsets, making the overall work quadratic in the\nprogram length.\n\nA privileged loader can submit 131072 unconditional jumps by zero followed\nby a valid return. Verification finishes quickly, but bpf_opt_remove_nops()\nthen spends a long time removing each jump separately. Since this\npost-verification work neither checks for signals nor reschedules, a pending\nSIGKILL cannot terminate the task until the rewrite finishes.\n\nMake bpf_patch_insn_data() and verifier_remove_insns() common cancellation\nand rescheduling points. These helpers run from BPF_PROG_LOAD process\ncontext, and bpf_patch_insn_data() can already sleep while reallocating\nauxiliary data.\n\nReport interrupted constant blinding as -EINTR and propagate it through\nboth JIT paths, including kernels that permit interpreter fallback.\nOther blinding failures retain the existing fallback behavior.\n\nThis does not reduce the quadratic cost of the rewrite passes, but it makes\nthe work preemptible and allows a killed loader to be torn down promptly.\n\n## Affected\n\n- `Linux >= 52875a04f4b26e7ef30a288ea096f7cfec0e93cd < 56dc616d7a1f7d134d3e101c455e62b0a24d0cfd`\n- `Linux >= 52875a04f4b26e7ef30a288ea096f7cfec0e93cd < 261b61d3735b042ae25634f795c4540be0fc140c`\n- `Linux 5.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}