All vulnerabilities
CVE-2026-98041

Linux: bpf: Don't predict JMP32 pointer vs zero comparisons

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.0High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.14%Chance of exploitation activity in the next 30 days, higher than 3% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6e1544986536734166176c3add504add23bcbd15Fixed versionCVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 6e1544986536734166176c3add504add23bcbd15LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Don't predict JMP32 pointer vs zero comparisons

Consider the following program:

r1 = map_value; /* low 32 bits are zero at runtime */ r6 = 0xdead000000000000; if w1 != 0 goto l1; l0: r1 += r6; r2 = *(u64 *)(r1 + 0); exit; l1: r6 = 0; goto l0;

At the moment is_branch_taken() reports the jump as always taken, because it does not distinguish between BPF_JMP and BPF_JMP32 comparisons when processing 'if w1 != 0 ...'.

Text from CVE List

Affected versions 12

  • Linuxaffected: cac616db39c207dc63465a4e05c6ce0e60b2cce4 before 6e1544986536734166176c3add504add23bcbd15CVE List
  • Linuxaffected: cac616db39c207dc63465a4e05c6ce0e60b2cce4 before d16f0eafcaa62e677a2b5b0dabc1f8d31dfe3d4dCVE List
  • Linuxaffected: cac616db39c207dc63465a4e05c6ce0e60b2cce4 before e2ae33247e8b2dbe9d116d3e61cadf6d548339c6CVE List
  • Linuxaffected: cac616db39c207dc63465a4e05c6ce0e60b2cce4 before a4d7f94c1ca914469ced665ec2f98be669aef462CVE List
  • Linuxaffected: cac616db39c207dc63465a4e05c6ce0e60b2cce4 before e51179a4e09846f8fd0f26a05068520de2b301bfCVE List
  • Linuxaffected: 5.8CVE List
  • Linuxunaffected: all versions before 5.8CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5