Riskcovery

CVE-2026-98041

bpf: Don't predict JMP32 pointer vs zero comparisons

State
Published
Severity
7.0 High
Published
Sep 25, 2026
Updated
Oct 21, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Don't predict JMP32 pointer vs zero comparisons

Consider the following program:

r1 = map_value; /* low 32 bits are zero at runtime */ r6 = 0xdead000000000000; if w1 != 0 goto l1; l0: r1 += r6; r2 = *(u64 *)(r1 + 0); exit; l1: r6 = 0; goto l0;

At the moment is_branch_taken() reports the jump as always taken, because it does not distinguish between BPF_JMP and BPF_JMP32 comparisons when processing 'if w1 != 0 ...'.

Scores

CVSSScoreVectorSource
3.17.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • cac616db39c207dc63465a4e05c6ce0e60b2cce4 to before 6e1544986536734166176c3add504add23bcbd15Affected
  • cac616db39c207dc63465a4e05c6ce0e60b2cce4 to before d16f0eafcaa62e677a2b5b0dabc1f8d31dfe3d4dAffected
  • cac616db39c207dc63465a4e05c6ce0e60b2cce4 to before e2ae33247e8b2dbe9d116d3e61cadf6d548339c6Affected
  • cac616db39c207dc63465a4e05c6ce0e60b2cce4 to before a4d7f94c1ca914469ced665ec2f98be669aef462Affected
  • cac616db39c207dc63465a4e05c6ce0e60b2cce4 to before e51179a4e09846f8fd0f26a05068520de2b301bfAffected
LinuxLinux
  • 5.8Affected
  • before 5.8Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.12.111 through 6.12.*Not affected
  • 6.18.53 through 6.18.*Not affected
  • 7.2.7 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.