CVE-2026-98647
Status: ReceivedUnscored—
Severity—Unscored
Exploitation probability0.17 %higher than 6% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix divide-by-zero in btf_struct_walk()
When an access goes past the struct and the last member is a flexible array, btf_struct_walk() folds the offset back into a single element with (off - moff) % t->size, but never checks that the element type has a size.
BTF takes an empty struct, so this in program BTF
divides by zero at prog load time. Getting there needs a PTR_TO_BTF_ID that is not MEM_ALLOC, e.g. a plain read of a local kptr stashed in a map from a sleepable program.
Reject a zero-sized element type. The fixed array path in the same function already bails out on the same thing:
Technical details traces, logs and code from the original report
/* event could be empty */
struct event {
#ifdef HAVE_TIMESTAMP
__u64 ts;
#endif
};
struct batch {
int nr;
struct event events[];
};
Oops: divide error: 0000 [#1] SMP KASAN PTI
RIP: 0010:btf_struct_walk+0x53f/0x1570
Call Trace:
<TASK>
btf_struct_access+0x42a/0xcd0
check_ptr_to_btf_access+0x4dc/0x1160
check_mem_access+0x3a45/0x8740
check_load_mem+0x36a/0xd10
do_check_common+0x3ef0/0xb210
bpf_check+0x6d3b/0x8580
bpf_prog_load+0xf7c/0x2720
__sys_bpf+0xa83/0x3690
__x64_sys_bpf+0xc7/0x150
x64_sys_call+0x1f3f/0x27e0
do_syscall_64+0xe5/0x610
entry_SYSCALL_64_after_hwframe+0x76/0x7e
</TASK>
btf_struct_walk()
...
/* skip empty array */
if (moff == mtrue_end)
continue;
msize /= total_nelems;CVSS
NVD hasn't assigned a CVSS score to this CVE (common since the April 2026 policy change).
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days
- 0.17 %
- Percentile among all scored CVEs
- 6
- Score date
- 10/20/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.
References
Show 7 references
- https://git.kernel.org/stable/c/172756f02663ad45c889c001c1a8cb4082a01a05
- https://git.kernel.org/stable/c/1ea3820937f8022e044c41c6e95c84b02741b45f
- https://git.kernel.org/stable/c/63af086cb5fa6f72fd924f86bea4c2194da663a2
- https://git.kernel.org/stable/c/8eb4cd72daad3a9ee63d2281bbdd16ce6d9406b1
- https://git.kernel.org/stable/c/934e9ba9f8d05656a48624710be67ca4dc8482e6
- https://git.kernel.org/stable/c/b0b3dc66529676228cb938cbcad66920f735c223
- https://git.kernel.org/stable/c/b8fa56722e9c43bcd59c51fe4c7edd5f4158a11b
Raw JSON (NVD)
Show
{
"id": "CVE-2026-98647",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "9c5f8a1008a121e4c6b24af211034e24b0b63081",
"lessThan": "1ea3820937f8022e044c41c6e95c84b02741b45f",
"versionType": "git"
},
{
"status": "affected",
"version": "9c5f8a1008a121e4c6b24af211034e24b0b63081",
"lessThan": "172756f02663ad45c889c001c1a8cb4082a01a05",
"versionType": "git"
},
{
"status": "affected",
"version": "9c5f8a1008a121e4c6b24af211034e24b0b63081",
"lessThan": "934e9ba9f8d05656a48624710be67ca4dc8482e6",
"versionType": "git"
},
{
"status": "affected",
"version": "9c5f8a1008a121e4c6b24af211034e24b0b63081",
"lessThan": "63af086cb5fa6f72fd924f86bea4c2194da663a2",
"versionType": "git"
},
{
"status": "affected",
"version": "9c5f8a1008a121e4c6b24af211034e24b0b63081",
"lessThan": "8eb4cd72daad3a9ee63d2281bbdd16ce6d9406b1",
"versionType": "git"
},
{
"status": "affected",
"version": "9c5f8a1008a121e4c6b24af211034e24b0b63081",
"lessThan": "b8fa56722e9c43bcd59c51fe4c7edd5f4158a11b",
"versionType": "git"
},
{
"status": "affected",
"version": "9c5f8a1008a121e4c6b24af211034e24b0b63081",
"lessThan": "b0b3dc66529676228cb938cbcad66920f735c223",
"versionType": "git"
}
],
"programFiles": [
"kernel/bpf/btf.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.8",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"kernel/bpf/btf.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:17.980",
"references": [
{
"url": "https://git.kernel.org/stable/c/172756f02663ad45c889c001c1a8cb4082a01a05",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1ea3820937f8022e044c41c6e95c84b02741b45f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/63af086cb5fa6f72fd924f86bea4c2194da663a2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8eb4cd72daad3a9ee63d2281bbdd16ce6d9406b1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/934e9ba9f8d05656a48624710be67ca4dc8482e6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b0b3dc66529676228cb938cbcad66920f735c223",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b8fa56722e9c43bcd59c51fe4c7edd5f4158a11b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix divide-by-zero in btf_struct_walk()\n\nWhen an access goes past the struct and the last member is a flexible\narray, btf_struct_walk() folds the offset back into a single element with\n(off - moff) % t->size, but never checks that the element type has a size.\n\nBTF takes an empty struct, so this in program BTF\n\n\t/* event could be empty */\n\tstruct event {\n #ifdef HAVE_TIMESTAMP\n\t\t__u64 ts;\n #endif\n\t};\n\n\tstruct batch {\n\t\tint nr;\n\t\tstruct event events[];\n\t};\n\ndivides by zero at prog load time. Getting there needs a PTR_TO_BTF_ID that\nis not MEM_ALLOC, e.g. a plain read of a local kptr stashed in a map from a\nsleepable program.\n\nOops: divide error: 0000 [#1] SMP KASAN PTI\nRIP: 0010:btf_struct_walk+0x53f/0x1570\nCall Trace:\n <TASK>\n btf_struct_access+0x42a/0xcd0\n check_ptr_to_btf_access+0x4dc/0x1160\n check_mem_access+0x3a45/0x8740\n check_load_mem+0x36a/0xd10\n do_check_common+0x3ef0/0xb210\n bpf_check+0x6d3b/0x8580\n bpf_prog_load+0xf7c/0x2720\n __sys_bpf+0xa83/0x3690\n __x64_sys_bpf+0xc7/0x150\n x64_sys_call+0x1f3f/0x27e0\n do_syscall_64+0xe5/0x610\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n </TASK>\n\nReject a zero-sized element type. The fixed array path in the same function\nalready bails out on the same thing:\n\n\tbtf_struct_walk()\n\t...\n\t\t/* skip empty array */\n\t\tif (moff == mtrue_end)\n\t\t\tcontinue;\n\n\t\tmsize /= total_nelems;"
}
],
"lastModified": "2026-10-19T10:19:29.113",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}