CVE-2026-98061

Executive Summary

CVE-2026-98061 is an unpatched vulnerability in the Linux kernel BPF verifier that allows a task with CAP_BPF to trigger a kernel WARN and force a BPF_PROG_LOAD failure via a crafted tail call from a synchronous callback frame. The flaw arises from inconsistent verifier state handling when tail calls are modeled as frame returns, reaching the "callback unexpected regs" invariant. Impact is limited to denial-of-service and potential verifier confusion for privileged BPF users; no public exploit or in-the-wild activity is known.

Technical Analysis

The Linux BPF verifier enforces control-flow and register-state invariants for eBPF programs before they are loaded into the kernel. One such invariant concerns tail calls: a tail call from a frame with non-zero depth is modeled by the verifier as an implicit return from that frame. To model this, the verifier marks R0 as unknown and invokes prepare_func_exit() on the branch taken by the tail call.

The vulnerability occurs when the current frame is a synchronous callback. In that context, prepare_func_exit() enforces the callback return-value contract and marks R0 as precise. On the tail-call path, however, R0 was synthesized by the verifier rather than derived from an actual instruction in the callback. Precision backtracking therefore reaches the callback-calling instruction with R0 still flagged as requested, violating verifier expectations and firing the "callback unexpected regs" diagnostic. The result is a kernel WARN and a failure of the BPF_PROG_LOAD syscall returning -EFAULT.

The attack surface is restricted to callers that already possess CAP_BPF (or equivalent privileged BPF access). Such a caller can submit a BPF program whose callback makes a direct tail call, causing verifier-state inconsistency. Tail calls reachable from callbacks are already rejected later during verification by check_max_stack_depth(), but that check occurs after the inconsistent return state is constructed, so the diagnostic fires before the rejection. The intended fix is to reject a tail call made directly by a callback before constructing the inconsistent return state, using the existing diagnostic. Tail calls from ordinary subprograms retain current behavior.

No CWE is assigned in the supplied data. The behavior is best characterized as a reachable assertion / verifier invariant violation (CWE-617 analog). No CVSS vector or score is assigned by NVD.

Exploitation Scenarios

No public proof-of-concept or exploit code is available. The following chain is inferred strictly from the vulnerability description and is bounded by its technical constraints.

1. Reconnaissance/target identification: An attacker identifies a Linux system where they already hold CAP_BPF (for example, a container with the capability granted, a privileged service account, or a host with unprivileged BPF disabled but CAP_BPF granted to a user). No remote reconnaissance is required; this is a local, privileged-BPF-context issue.

2. Triggering the flaw class: The attacker constructs and submits an eBPF program using BPF_PROG_LOAD in which a synchronous callback performs a tail call directly. The verifier models the tail call as a return from the non-zero callback frame, marks R0 unknown, and calls prepare_func_exit(). Because the frame is a synchronous callback, prepare_func_exit() enforces the callback return contract and marks R0 precise. Precision backtracking then reaches the callback-calling instruction with R0 still requested, producing the "callback unexpected regs" verifier diagnostic.

3. Execution method: The trigger is the BPF_PROG_LOAD syscall itself. No memory corruption payload is described; the observable effect is a kernel WARN and an -EFAULT failure of the load operation.

4. Post-exploitation impact: The direct impact is a kernel warning (log noise, potential panic if panic-on-warn is configured) and failed program load. The description does not establish arbitrary code execution, privilege escalation, or memory disclosure. The primary risk is denial of service (via WARN-triggered panic configurations or repeated verifier-failure churn) and verifier inconsistency in privileged BPF contexts.

No public PoC available; attack chain is inferred from vulnerability class.

Impact Assessment

CVE-2026-98061 affects the Linux kernel BPF verifier across unpatched versions. Exploitation requires CAP_BPF, meaning the attacker is already a privileged BPF user; the vulnerability does not grant privilege escalation on its own. The principal impact is denial of service: a WARN in the verifier can escalate to a kernel panic on systems configured with panic_on_warn=1, and repeated verifier failures can disrupt workloads relying on BPF program loading. Because no CVSS vector is assigned by NVD, no subscores can be cited; the absence of an assigned score reflects incomplete scoring at the time of this report. Blast radius is limited to hosts or containers where a CAP_BPF-capable principal can submit eBPF programs. EPSS is not yet scored by FIRST.org, and CVE-2026-98061 is not listed in CISA KEV.

Detection Guidance

Sigma Rule

title: Linux BPF Prog Load Failure with Callback Unexpected Regs Diagnostic
id: 8f3c1a42-5b7e-4d9a-9c21-0f6e2d7b4a10
status: experimental
description: Detects repeated BPF_PROG_LOAD failures returning EFAULT accompanied by kernel WARN "callback unexpected regs", indicative of CVE-2026-98061 trigger attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-98061
author: valtersit.com
date: 2026-01-01
logsource:
  product: linux
  service: kernel
detection:
  selection_msg:
    - 'callback unexpected regs'
    - 'WARNING: CPU'
  selection_bpf:
    Message|contains:
      - 'BPF_PROG_LOAD'
      - 'bpf'
  condition: selection_msg and selection_bpf
falsepositives:
  - Legitimate BPF program development with faulty programs
  - Kernel self-tests exercising verifier diagnostics
level: medium
tags:
  - attack.t1068
  - cve.2026.98061

YARA Rule

rule CVE_2026_98061_BPF_Callback_Tailcall_Diagnostic
{
    meta:
        description = "Detects strings associated with CVE-2026-98061 BPF verifier callback tail-call state inconsistency"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-98061"
        date = "2026-01-01"
    strings:
        $s1 = "callback unexpected regs" ascii wide
        $s2 = "prepare_func_exit" ascii
        $s3 = "check_max_stack_depth" ascii
        $s4 = "BPF_PROG_LOAD" ascii
    condition:
        uint32(0) == 0x464c457f and any of ($s1, $s2, $s3, $s4)
}

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2026-98061 Linux BPF verifier callback tail-call attempt (local only - limited network visibility)"; content:"BPF_PROG_LOAD"; nocase; classtype:attempted-dos; sid:202698061; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-98061;)

Elastic Detection

process where host.os.type == "linux" and event.action == "exec" and process.name in ("bpftool", "bpftrace")

Note: CVE-2026-98061 is triggered via the local BPF_PROG_LOAD syscall, not via network traffic; detection focuses on host-level BPF tooling and kernel WARN telemetry (dmesg/journalctl) containing "callback unexpected regs". No reliable network signature exists.

Splunk SPL Query

index=linux_syslog OR index=os (sourcetype=syslog OR sourcetype=linux_secure)
("callback unexpected regs" OR "BPF_PROG_LOAD" OR "prepare_func_exit")
| stats count min(_time) as first_seen max(_time) as last_seen by host
| where count > 1
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="linux,cve_2026_98061,">
  <rule id="202698061" level="7">
    <decoded_as>syslog</decoded_as>
    <match>callback unexpected regs</match>
    <description>CVE-2026-98061: BPF verifier callback unexpected regs diagnostic triggered - possible verifier state inconsistency in BPF tail-call from callback</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>cve_2026_98061,bpf,</group>
  </rule>
  <rule id="202698062" level="5">
    <decoded_as>syslog</decoded_as>
    <match>BPF_PROG_LOAD</match>
    <match>EFAULT</match>
    <description>CVE-2026-98061: BPF_PROG_LOAD failed with EFAULT, possible attempt to trigger verifier invariant violation</description>
    <group>cve_2026_98061,bpf,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict CAP_BPF (and CAP_SYS_ADMIN where applicable) to the smallest possible set of trusted processes, users, and containers. Removing unnecessary BPF capabilities prevents triggering the verifier state inconsistency.
   • Where operationally feasible, avoid panic_on_warn=1 on systems that allow privileged BPF loads, since the vulnerability's primary observable impact is a WARN.
   • Monitor kernel logs for the "callback unexpected regs" diagnostic and repeated BPF_PROG_LOAD EFAULT failures as an early signal of attempted triggering.

2. Patch/upgrade steps:

   • No vendor patch is currently available from any tracked source. Monitor upstream Linux kernel stable and longterm trees for a fix titled "bpf: Reject tail calls directly from callback frames" or equivalent.
   • Once a patched kernel is released by the distribution vendor, upgrade and reboot into the fixed kernel; re-verify BPF workloads after upgrade.

3. Long-term hardening:

   • Apply capability least-privilege to BPF: prefer disabling unprivileged BPF (kernel.unprivileged_bpf_disabled=1) and gate CAP_BPF behind explicit review.
   • Maintain an inventory of workloads that rely on BPF callbacks and tail calls so verifier behavior changes can be evaluated on upgrade.
   • Track CVE-2026-98061 in vulnerability management and re-score when NVD publishes a CVSS vector and FIRST.org publishes EPSS.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-98061
• Linux kernel BPF verifier documentation: https://www.kernel.org/doc/html/latest/bpf/verifier.html
• Linux kernel stable tree (monitor for "bpf: Reject tail calls directly from callback frames"): https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
• CISA Known Exploited Vulnerabilities Catalog (not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (not yet scored): https://www.first.org/epss

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-98061 at the time of this report.