CVE-2026-98085Hinoki check available

Kernel crash via misframed BPF precision backtracking

Published Sep 25, 2026 · Updated Sep 25, 2026

Improper BPF verifier backtracking in Linux allows local users to crash verification or trigger unsound state pruning with crafted bytecode. In backtrack_insn(), an implicit subprogram-exit edge for BPF_LD_ABS or BPF_LD_IND fails to enter the caller frame, so precision marks are manipulated against instructions from the wrong frame. Reachability requires permission to load BPF programs; disabling unprivileged BPF limits that permission to CAP_SYS_ADMIN or CAP_BPF holders.

CVSS severityUnavailable
Unscored
EPSS probability0.17%
Next 30 days · Oct 19, 2026
Known exploitationUnconfirmed
Based on sourced intelligence
Hinoki checkAvailable
Coverage for this vulnerability

See if you're affected

Explore vulnerability checks for your environment with Hinoki.

Get started

Summary

What happened

Improper BPF verifier backtracking in Linux allows local users to crash verification or trigger unsound state pruning with crafted bytecode. In backtrack_insn(), an implicit subprogram-exit edge for BPF_LD_ABS or BPF_LD_IND fails to enter the caller frame, so precision marks are manipulated against instructions from the wrong frame. Reachability requires permission to load BPF programs; disabling unprivileged BPF limits that permission to CAP_SYS_ADMIN or CAP_BPF holders.

The record

CVE
CVE-2026-98085
Published
Sep 25, 2026
Updated
Sep 25, 2026
Vendor
The Linux Kernel Organization
Product
Linux
Classifications
Unavailable
Attack vector
local
Privileges
Unavailable

Timeline

How it unfolded

  1. Sep 25, 2026CVE publishedPublication date reported by the CVE source.
  2. Sep 25, 2026Record updatedLatest update available in the CVE record.

Exploitability

Present is not the same as exploitable

Compare your product and version with the public record. A matching version still requires validation against your environment.

Is a vulnerable build present?

Compare these published version ranges with your installed build and any vendor patches.

  1. Affected versionversion=37ad2bb11e9de92cb7b94548705eeedd87f7d392
  2. Affected versionversion=5.10.265 <5.11
  3. Affected versionversion=5.15.216 <5.16
  4. Affected versionversion=6.1.183 <6.2
  5. Affected versionversion=6.12.101 <6.13
  6. Affected versionversion=6.18.42 <6.19
  7. Affected versionversion=6.6.148 <6.7
  8. Affected versionversion=7.0.10 <7.1
  9. Affected versionversion=7.1
  10. Affected versionversion=8674e2db06cff6b50f2216eed9a761d15425bb34
  11. Affected versionversion=8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbe
  12. Affected versionversion=928d354ae3557e8f755a227e67be88034eb3cd7f
  13. Affected versionversion=ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337
  14. Affected versionversion=d846d83bdacbd8f14fc45c63b8c1d22608452e1c
  15. Affected versionversion=de1055e7f9e67af32b1f3376066272b04e5223c0
  16. Affected versionversion=ee861486e377edc55361c08dcbceab3f6b6577bd <387b1baefbb776e3f48dc2261e77a49213f470f7
  17. Affected versionversion=ee861486e377edc55361c08dcbceab3f6b6577bd <671b7b9a660ef15b25faa3df161205b9dc8d1eb2

What conditions does exploitation require?

Attack vectorlocal
Required privilegesUnavailable in this record.

What is affected?

The Linux Kernel Organization · Linuxversion=37ad2bb11e9de92cb7b94548705eeedd87f7d392; version=5.10.265 <5.11; version=5.15.216 <5.16; version=6.1.183 <6.2; version=6.12.101 <6.13; version=6.18.42 <6.19; version=6.6.148 <6.7; version=7.0.10 <7.1; version=7.1; version=8674e2db06cff6b50f2216eed9a761d15425bb34; version=8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbe; version=928d354ae3557e8f755a227e67be88034eb3cd7f; version=ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337; version=d846d83bdacbd8f14fc45c63b8c1d22608452e1c; version=de1055e7f9e67af32b1f3376066272b04e5223c0; version=ee861486e377edc55361c08dcbceab3f6b6577bd <387b1baefbb776e3f48dc2261e77a49213f470f7; version=ee861486e377edc55361c08dcbceab3f6b6577bd <671b7b9a660ef15b25faa3df161205b9dc8d1eb2

Published CVSS scores

No CVSS assessment is available in this record.

CVSS describes severity. EPSS estimates exploitation probability.

Attacks

What attackers are doing with it

Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.

Activity data is delayed. The latest report is Sep 28, 2026.

Daily unique IPsNo honeypot observations are available for this CVE in the selected window.

No observations available

Sep 22, 2026Sep 28, 2026
Latest reporting daySep 28, 2026
Latest daily unique IPsUnavailable
Prior 30-day averageUnavailable
SourceShadowserver honeypots (KEV)
Vectorlocal
PrivilegesUnavailable
Known exploitationUnconfirmed
Public exploitUnconfirmed

Weakness, pattern, technique

No sourced classifications are available.

Public exploit references

No public exploit references are available in this record.

Labels summarize the accepted research assessment. They do not indicate a test against your environment.

Technologies

Your stack

See the directory against your own environment.

Your stack

Check the software in your environment

Get started to see how Hinoki identifies affected software and validates exploitability in your environment.

Get started