CVE-2026-98856

kprobes: Skip disarmed probes when checking optkprobe overlap

State: Published
Severity: Not scored
Published: Oct 18, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

kprobes: Skip disarmed probes when checking optkprobe overlap

On x86, an optkprobe at A replaces five bytes with a jump. If a disabled probe B is at A+2, get_optimized_kprobe() stops at B when arming a new probe C at A+4. It leaves A optimized:

A A+1 A+2 A+3 A+4 A's jump | e9 | d0 | d1 | d2 | d3 | after C | e9 | d0 | d1 | d2 | cc |

The INT3 for C overwrites the last byte of A's jump displacement, so execution can jump to the wrong address. B can have prepared optinsns while disarmed, but has no jump to unoptimize.

Continue past disarmed and unprepared probes to find the active optimized probe before arming a probe in its jump.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	afd66255b9a48f5851326ddae50e2203fbf71dc9 to before e29e819cacfb4e3cd56d41eb704ab4718d6d2915Affected afd66255b9a48f5851326ddae50e2203fbf71dc9 to before ab9ed9faa67bf67383ff7e1479655e232a843c2bAffected afd66255b9a48f5851326ddae50e2203fbf71dc9 to before 3b0f604df9e2b9a456f1ae5266a439998c4c8826Affected afd66255b9a48f5851326ddae50e2203fbf71dc9 to before 3f968dcdf018861129f97910fa7bd680d939a9b0Affected afd66255b9a48f5851326ddae50e2203fbf71dc9 to before 985a568171e7bdba6dcde3420d0e5bb515813457Affected afd66255b9a48f5851326ddae50e2203fbf71dc9 to before 6745fa65f4115045431c0c15610e876855a04625Affected afd66255b9a48f5851326ddae50e2203fbf71dc9 to before 526fac219e8b7d3369b43026bd0a1df51b811cd4Affected afd66255b9a48f5851326ddae50e2203fbf71dc9 to before 7a39c732a22ec4a369af9e19fbe3d666ec83eec4Affected
LinuxLinux	2.6.34Affected before 2.6.34Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.18.56 through 6.18.Not affected 7.2.10 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

afd66255b9a48f5851326ddae50e2203fbf71dc9 to before e29e819cacfb4e3cd56d41eb704ab4718d6d2915Affected
afd66255b9a48f5851326ddae50e2203fbf71dc9 to before ab9ed9faa67bf67383ff7e1479655e232a843c2bAffected
afd66255b9a48f5851326ddae50e2203fbf71dc9 to before 3b0f604df9e2b9a456f1ae5266a439998c4c8826Affected
afd66255b9a48f5851326ddae50e2203fbf71dc9 to before 3f968dcdf018861129f97910fa7bd680d939a9b0Affected
afd66255b9a48f5851326ddae50e2203fbf71dc9 to before 985a568171e7bdba6dcde3420d0e5bb515813457Affected
afd66255b9a48f5851326ddae50e2203fbf71dc9 to before 6745fa65f4115045431c0c15610e876855a04625Affected
afd66255b9a48f5851326ddae50e2203fbf71dc9 to before 526fac219e8b7d3369b43026bd0a1df51b811cd4Affected
afd66255b9a48f5851326ddae50e2203fbf71dc9 to before 7a39c732a22ec4a369af9e19fbe3d666ec83eec4Affected

LinuxLinux

2.6.34Affected
before 2.6.34Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.18.56 through 6.18.*Not affected
7.2.10 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.