CVE-2026-98641 Linux CVE debrief

Who should care

Linux kernel maintainers, developers, and users who utilize BPF on arm64 architectures should assess exposure and apply patches. Operators of Linux systems using BPF on arm64 architectures should verify frame pointer setup for exception callbacks in BPF and assess potential impact on BPF usage and kernel stability.

Why it matters

Linux kernel vulnerability involving bpf and arm64 exception callback frame pointer setup requires verification of exposure and impact on BPF usage.

• Verify frame pointer setup for exception callbacks in BPF on arm64
• Assess potential impact on BPF usage and kernel stability

Technical summary

The Linux kernel vulnerability involves the setup of the frame pointer for the exception callback in the bpf subsystem on arm64 architectures. A program acting as an exception boundary saves all callee-saved registers, but the callback prologue does not emit the mov x25, sp instruction that points BPF_REG_FP at the frame the callback runs on. This can lead to stack accesses through BPF_REG_FP being rewritten to be stack pointer relative, potentially causing the helper to write over its own return address. The epilogue restores it from the main program's save area along with the other callee-saved registers, as it already does.

Defensive priority

Verify Linux kernel versions and configurations for exposure, assess impact on BPF usage

Recommended defensive actions

• Verify Linux kernel versions and configurations for exposure
• Assess impact on BPF usage
• Review and apply patches from Linux vendor
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but evidence of exploitation is not provided. The vulnerability involves bpf and arm64 exception callback frame pointer setup, requiring verification of exposure and impact on BPF usage. Linux kernel maintainers, developers, and users who utilize BPF on arm64 architectures should assess exposure and apply patches.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.