CVE-2026-98869: Linux Kernel BPF Privilege Escalation

CVE-2026-98869 Overview

CVE-2026-98869 is a vulnerability in the Linux kernel's Berkeley Packet Filter (BPF) verifier. The verifier's 32-bit zero extension logic is broken, affecting the correctness of BPF programs on the s390 architecture. The flaw stems from the removal of chain-based liveness tracking in a prior commit, which eliminated a propagation step that previously marked instructions requiring explicit zero extension. As a result, a BPF program can reach a verifier checkpoint along a path where a register's upper half is uninitialized, bypassing the zext_dst marking and leaving the upper 32 bits of a 64-bit register populated with attacker-influenced data.

Critical Impact
A crafted BPF program can inject arbitrary values into the upper half of a 64-bit register, violating BPF semantics and undermining verifier safety guarantees on affected kernels.

Affected Products

Linux kernel (BPF subsystem)
s390 architecture JIT compiled BPF programs
Downstream distributions shipping affected mainline revisions

Discovery Timeline

2026-10-21 - CVE CVE-2026-98869 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98869

Vulnerability Analysis

The BPF verifier minimizes inserted zero extensions by tracking whether the upper halves of 64-bit registers are ever read. Historically, the verifier combined per-instruction subreg_def tracking in bpf_reg_state with liveness propagation via REG_LIVE_READ32 and REG_LIVE_READ64 flags. The propagate_liveness() routine called mark_insn_zext() to transfer knowledge of live upper halves across verifier paths.

Commit 107e16979905 removed the chain-based liveness mechanism. After that change, subreg_def alone governed whether the post-verification pass bpf_opt_subreg_zext_lo32_rnd_hi32() inserted explicit zero extension. Because subreg_def is tied to the current verifier state rather than a global analysis, divergent paths can share a checkpoint while disagreeing on upper-half initialization.

Root Cause

The root cause is loss of cross-path liveness propagation for register sub-halves. When path P1 writes and uses the upper half of a register and path P2 leaves it uninitialized, both paths can converge on checkpoint C. The initializing instruction on P2 never receives the zext_dst mark, so the JIT skips the zero extension and the program observes attacker-controlled bits in the upper half.

Attack Vector

Exploitation requires the ability to load a BPF program accepted by the verifier. A local actor with BPF loading privileges can craft an instruction sequence that creates divergent verification paths sharing a checkpoint, then relies on the missed zero extension on s390 to read or compute with uninitialized high bits. The fix replaces subreg_def tracking with a static analysis in bpf_compute_live_registers() that marks zext_dst whenever a 32-bit subregister is defined while the upper half remains live.

The vulnerability manifests inside the verifier's liveness analysis. See the Linux Kernel commit for the full patch and technical commentary.

Detection Methods for CVE-2026-98869

Indicators of Compromise

Unexpected BPF program load events on s390 systems from non-root or lightly privileged workloads.
BPF programs that pass verification but produce arithmetic results inconsistent with 32-bit zero extension semantics.
Kernel log anomalies referencing BPF verifier state or JIT output on s390 hosts.

Detection Strategies

Audit bpf() syscall usage with BPF_PROG_LOAD commands, correlating caller UID, capabilities, and program type.
Enable kernel audit rules for BPF program loads and compare against an approved baseline of system and application BPF users.
Review JIT-compiled BPF output on s390 build and production systems for missing zero extension instructions after 32-bit operations.

Monitoring Recommendations

Monitor processes that invoke bpf() with CAP_BPF or CAP_SYS_ADMIN and alert on unexpected loaders.
Track kernel versions across the fleet to confirm patched builds are deployed on s390 systems first.
Collect verifier logs via bpftool prog and dmesg during program load for forensic review.

How to Mitigate CVE-2026-98869

Immediate Actions Required

Apply the upstream Linux kernel patch that replaces subreg_def logic with static liveness analysis in bpf_compute_live_registers().
Prioritize patching s390 systems, where the JIT depends on verifier-emitted zero extensions.
Restrict CAP_BPF and CAP_SYS_ADMIN to trusted service accounts and remove unprivileged BPF access where feasible.

Patch Information

The fix is available in the mainline Linux kernel tree. See the Linux Kernel commit 7ce090afbf72 for the authoritative patch. Rebuild and redeploy affected kernel packages, then validate on s390 nodes before rolling out broadly.

Workarounds

Set kernel.unprivileged_bpf_disabled=1 via sysctl to prevent unprivileged users from loading BPF programs.
Disable the BPF JIT on s390 where operationally acceptable by setting net.core.bpf_jit_enable=0.
Enforce Linux Security Module policies (SELinux, AppArmor) that restrict which processes may invoke bpf().

bash

# Configuration example
sysctl -w kernel.unprivileged_bpf_disabled=1
sysctl -w net.core.bpf_jit_harden=2
# Persist across reboots
echo 'kernel.unprivileged_bpf_disabled=1' >> /etc/sysctl.d/99-bpf-hardening.conf
echo 'net.core.bpf_jit_harden=2' >> /etc/sysctl.d/99-bpf-hardening.conf