---
id: CVE-2026-98647
title: 'bpf: Fix divide-by-zero in btf_struct_walk()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Fix divide-by-zero in btf_struct_walk()

  When an access goes past the struct and the last member is a flexible
  array, btf_struct_walk() folds the offset back into …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 9c5f8a1008a121e4c6b24af211034e24b0b63081 <
    1ea3820937f8022e044c41c6e95c84b02741b45f
  - >-
    Linux >= 9c5f8a1008a121e4c6b24af211034e24b0b63081 <
    172756f02663ad45c889c001c1a8cb4082a01a05
  - >-
    Linux >= 9c5f8a1008a121e4c6b24af211034e24b0b63081 <
    934e9ba9f8d05656a48624710be67ca4dc8482e6
  - >-
    Linux >= 9c5f8a1008a121e4c6b24af211034e24b0b63081 <
    63af086cb5fa6f72fd924f86bea4c2194da663a2
  - >-
    Linux >= 9c5f8a1008a121e4c6b24af211034e24b0b63081 <
    8eb4cd72daad3a9ee63d2281bbdd16ce6d9406b1
  - >-
    Linux >= 9c5f8a1008a121e4c6b24af211034e24b0b63081 <
    b8fa56722e9c43bcd59c51fe4c7edd5f4158a11b
  - >-
    Linux >= 9c5f8a1008a121e4c6b24af211034e24b0b63081 <
    b0b3dc66529676228cb938cbcad66920f735c223
  - Linux 5.8
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:20:18.360Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98647'
references:
  - url: 'https://git.kernel.org/stable/c/1ea3820937f8022e044c41c6e95c84b02741b45f'
  - url: 'https://git.kernel.org/stable/c/172756f02663ad45c889c001c1a8cb4082a01a05'
  - url: 'https://git.kernel.org/stable/c/934e9ba9f8d05656a48624710be67ca4dc8482e6'
  - url: 'https://git.kernel.org/stable/c/63af086cb5fa6f72fd924f86bea4c2194da663a2'
  - url: 'https://git.kernel.org/stable/c/8eb4cd72daad3a9ee63d2281bbdd16ce6d9406b1'
  - url: 'https://git.kernel.org/stable/c/b8fa56722e9c43bcd59c51fe4c7edd5f4158a11b'
  - url: 'https://git.kernel.org/stable/c/b0b3dc66529676228cb938cbcad66920f735c223'
tags:
  - cve.org
ingestedAt: '2026-10-18T15:45:12.229Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix divide-by-zero in btf_struct_walk()

When an access goes past the struct and the last member is a flexible
array, btf_struct_walk() folds the offset back into a single element with
(off - moff) % t->size, but never checks that the element type has a size.

BTF takes an empty struct, so this in program BTF

	/* event could be empty */
	struct event {
 #ifdef HAVE_TIMESTAMP
		__u64 ts;
 #endif
	};

	struct batch {
		int nr;
		struct event events[];
	};

divides by zero at prog load time. Getting there needs a PTR_TO_BTF_ID that
is not MEM_ALLOC, e.g. a plain read of a local kptr stashed in a map from a
sleepable program.

Oops: divide error: 0000 [#1] SMP KASAN PTI
RIP: 0010:btf_struct_walk+0x53f/0x1570
Call Trace:
 <TASK>
 btf_struct_access+0x42a/0xcd0
 check_ptr_to_btf_access+0x4dc/0x1160
 check_mem_access+0x3a45/0x8740
 check_load_mem+0x36a/0xd10
 do_check_common+0x3ef0/0xb210
 bpf_check+0x6d3b/0x8580
 bpf_prog_load+0xf7c/0x2720
 __sys_bpf+0xa83/0x3690
 __x64_sys_bpf+0xc7/0x150
 x64_sys_call+0x1f3f/0x27e0
 do_syscall_64+0xe5/0x610
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
 </TASK>

Reject a zero-sized element type. The fixed array path in the same function
already bails out on the same thing:

	btf_struct_walk()
	...
		/* skip empty array */
		if (moff == mtrue_end)
			continue;

		msize /= total_nelems;

## Affected

- `Linux >= 9c5f8a1008a121e4c6b24af211034e24b0b63081 < 1ea3820937f8022e044c41c6e95c84b02741b45f`
- `Linux >= 9c5f8a1008a121e4c6b24af211034e24b0b63081 < 172756f02663ad45c889c001c1a8cb4082a01a05`
- `Linux >= 9c5f8a1008a121e4c6b24af211034e24b0b63081 < 934e9ba9f8d05656a48624710be67ca4dc8482e6`
- `Linux >= 9c5f8a1008a121e4c6b24af211034e24b0b63081 < 63af086cb5fa6f72fd924f86bea4c2194da663a2`
- `Linux >= 9c5f8a1008a121e4c6b24af211034e24b0b63081 < 8eb4cd72daad3a9ee63d2281bbdd16ce6d9406b1`
- `Linux >= 9c5f8a1008a121e4c6b24af211034e24b0b63081 < b8fa56722e9c43bcd59c51fe4c7edd5f4158a11b`
- `Linux >= 9c5f8a1008a121e4c6b24af211034e24b0b63081 < b0b3dc66529676228cb938cbcad66920f735c223`
- `Linux 5.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.