CVE-2026-98061

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject tail calls directly from callback frames

A tail call from a non-zero frame is modeled as a return from that frame.

The verifier makes R0 unknown and calls prepare_func_exit() for the taken

branch.

When the current frame is a synchronous callback, prepare_func_exit()

enforces the callback return-value contract and marks R0 precise. Since the

tail-call path synthesized R0 rather than deriving it from an instruction,

precision backtracking reaches the callback-calling instruction with R0

still requested and triggers the "callback unexpected regs" verifier bug.

A CAP_BPF task can therefore cause a WARN and an -EFAULT BPF_PROG_LOAD.

Tail calls reachable from callbacks are already rejected later by

check_max_stack_depth(). Reject a tail call made directly by a callback

before constructing the inconsistent return state, using the existing

diagnostic. Tail calls from ordinary subprograms keep their current

behavior.