CVE-2026-98589

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject pkt arguments in mutating subprogs

The verifier tracks changes in how PTR TO PACKET registers' bounds are modified across subprog boundaries. PTR TO PACKET registers are actually passed as PTR TO MEM, which is assumed valid for the entire call. This is not the case with packet memory, where a pskb * call may invalidate its memory region.

Reject BPF code that passes PTR TO PACKET pointers to subprogs that may mutate a packet. We cannot pass the pointer as a true PTR TO PACKET because we would also need to somehow pass the PTR TO PACKET META or PTR TO PACKET END to the subprog. Since we cannot avoid representing the pointer in the subprog as PTR TO MEM, only permit it if the subprog is guaranteed not to mutate the packet.