CVE-2026-98647

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix divide-by-zero in btf struct walk()

When an access goes past the struct and the last member is a flexible array, btf struct walk() folds the offset back into a single element with (off - moff) % t->size, but never checks that the element type has a size.

BTF takes an empty struct, so this in program BTF

/* event could be empty */
struct event {

#ifdef HAVE TIMESTAMP u64 ts; #endif };

struct batch {
	int nr;
	struct event events[];
};

divides by zero at prog load time. Getting there needs a PTR TO BTF ID that is not MEM ALLOC, e.g. a plain read of a local kptr stashed in a map from a sleepable program.

Oops: divide error: 0000 [#1] SMP KASAN PTI RIP: 0010:btf struct walk+0x53f/0x1570 Call Trace: btf struct access+0x42a/0xcd0 check ptr to btf access+0x4dc/0x1160 check mem access+0x3a45/0x8740 check load mem+0x36a/0xd10 do check common+0x3ef0/0xb210 bpf check+0x6d3b/0x8580 bpf prog load+0xf7c/0x2720 sys bpf+0xa83/0x3690 x64 sys bpf+0xc7/0x150 x64 sys call+0x1f3f/0x27e0 do syscall 64+0xe5/0x610 entry SYSCALL 64 after hwframe+0x76/0x7e

Reject a zero-sized element type. The fixed array path in the same function already bails out on the same thing:

btf struct walk()
...
	/* skip empty array */
	if (moff == mtrue end)
		continue;

	msize /= total nelems;