---
id: CVE-2026-98540
title: 'fprobe: Terminate the fgraph_data list when the reservation is not filled'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fprobe: Terminate the fgraph_data list when the reservation is not filled

  fprobe_fgraph_entry() reserves shadow stack space for every fprobe with
  an exit handler, but …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e0a384434ae1bdfb03954c46c464e3dbd3223ad6 <
    b7459fddcb27a4b7d01067678172afa362cf660d
  - >-
    Linux >= e0a384434ae1bdfb03954c46c464e3dbd3223ad6 <
    1d653a183973f5283a3db5a38cd5e195eb152244
  - Linux 7.1
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:18:08.352Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98540'
references:
  - url: 'https://git.kernel.org/stable/c/b7459fddcb27a4b7d01067678172afa362cf660d'
  - url: 'https://git.kernel.org/stable/c/1d653a183973f5283a3db5a38cd5e195eb152244'
tags:
  - cve.org
ingestedAt: '2026-10-18T15:45:12.268Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

fprobe: Terminate the fgraph_data list when the reservation is not filled

fprobe_fgraph_entry() reserves shadow stack space for every fprobe with
an exit handler, but only fills it for those whose entry handler returns
0. fgraph_reserve_data() does not clear the area, so fprobe_return()
parses the unused tail as headers left over from an earlier call, and an
exit handler can run twice or despite its entry handler asking to skip
it.

Write a zero word after the last entry to terminate the walk. A zeroed
slot does not decode to a NULL fprobe on the arches that encode the
header into one unsigned long, since arch_decode_fprobe_header_fp() ORs
in FPROBE_HEADER_MSB_PATTERN, so make read_fprobe_header() return NULL
for a zeroed slot.

## Affected

- `Linux >= e0a384434ae1bdfb03954c46c464e3dbd3223ad6 < b7459fddcb27a4b7d01067678172afa362cf660d`
- `Linux >= e0a384434ae1bdfb03954c46c464e3dbd3223ad6 < 1d653a183973f5283a3db5a38cd5e195eb152244`
- `Linux 7.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.