CVE-2026-98048

In the Linux kernel, the following vulnerability has been resolved:

bpf: don't rewrite bpf fastcall patterns entered by a jump

mark fastcall pattern for call() must ensure that matched "spill; call; fill" instruction series is not interrupted by a jump. Otherwise the rewrite applied by bpf remove fastcall spills fills() is not sound.

Record the instructions targeted by jumps in insn aux data[*].jump target when the CFG is built and use this flag to stop growing a pattern at such an instruction. Jumps to the first spill are fine.

Note that existing insn aux data[*].jmp point field can't be reused, as it marks subprogram return instructions.