01 Record

CVE-2026-98085

bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge

UnratedPUBLISHEDCNA: Linux

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.20% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 9.8% of scored records. A rank, not a probability.
NVD base score: The NVD has published no score for this record
NVD CVSS vector: No NVD score to derive
NVD analysis status: Undergoing Analysis. NVD last modified this record on 2026-10-21.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-09-25 10:24Z1 MO AGO

Last updated

2026-10-21 12:54Z7 DAYS AGO

Reserved

2026-09-25

Assigning CNA

Linux

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-476NULL Pointer DereferenceBase

Data version

5.2

Document digest

c4ace74ee57ef000bd96d5ab0601aebfc0db56fc48e1248ea293f848ee33072a

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux37ad2bb11e9de92cb7b94548705eeedd87f7d392 to < 19cca7c36055906b3cff3e297618ee8a50cde25d, 8674e2db06cff6b50f2216eed9a761d15425bb34 to < 12c064bcfa56e3631be9f5336ee113b7f849959a, ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337 to < a0cd9e22f8faed30a8da8be357c51bd8b3074ee9, ee861486e377edc55361c08dcbceab3f6b6577bd to < 671b7b9a660ef15b25faa3df161205b9dc8d1eb2, ee861486e377edc55361c08dcbceab3f6b6577bd to < 387b1baefbb776e3f48dc2261e77a49213f470f7, 928d354ae3557e8f755a227e67be88034eb3cd7f, 8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbe, de1055e7f9e67af32b1f3376066272b04e5223c0, d846d83bdacbd8f14fc45c63b8c1d22608452e1c, 6.6.148 to < 6.6.160, 6.12.101 to < 6.12.114, 6.18.42 to < 6.18.57, 5.10.265 to < 5.11, 5.15.216 to < 5.16, 6.1.183 to < 6.2, 7.0.10 to < 7.1, 7.1—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/19cca7c36055906b3cff3e297618ee8a50cde25d
git.kernel.orghttps://git.kernel.org/stable/c/12c064bcfa56e3631be9f5336ee113b7f849959a
git.kernel.orghttps://git.kernel.org/stable/c/a0cd9e22f8faed30a8da8be357c51bd8b3074ee9
git.kernel.orghttps://git.kernel.org/stable/c/671b7b9a660ef15b25faa3df161205b9dc8d1eb2
git.kernel.orghttps://git.kernel.org/stable/c/387b1baefbb776e3f48dc2261e77a49213f470f7

07 Fixed in

Debian 12

linux
No fix yet

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
No fix yet

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.2.7-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.