kernel: bpf: Infer zext_dst based on static register liveness analysis (CVE-2026-98869)

Overview

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) verifier. A local attacker could achieve privilege escalation by loading a specially crafted BPF program into the kernel. The vulnerability occurs because the verifier fails to properly track register states across execution paths during 32-bit operations, leading to missing zero-extension instructions. Consequently, an attacker can inject arbitrary values into 64-bit registers to bypass kernel safety checks and compromise system memory.

Vendor advisories

• Red Hat VEX · Important · affected: Red Hat Enterprise Linux 10 · no fix planned: Red Hat Enterprise Linux 10 · updated 2026-10-24 · vex

kernel: bpf: Infer zext_dst based on static register liveness analysis — rated Important by Red Hat. Released 2026-10-21, updated 2026-10-24.

Affected:

• Red Hat Enterprise Linux 10

No fix planned:

• Red Hat Enterprise Linux 10

Not affected:

• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Red Hat OpenShift Container Platform 4

Remediation

Affected