All vulnerabilities
CVE-2026-98631

Linux: xsk: Use a 32-bit compare in xsk_map_gen_lookup

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in227ec890559e922e235eb543646e3bf0bd8269b0Also 11d9be35c1f4233798e99be98bc474f83a254c6c, 123f90f394ca404ab8796a7c8072ff7fa5b65a9c and 3 moreCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 227ec890559e922e235eb543646e3bf0bd8269b0LinuxCVE List
  • 11d9be35c1f4233798e99be98bc474f83a254c6cLinuxCVE List
  • 123f90f394ca404ab8796a7c8072ff7fa5b65a9cLinuxCVE List
  • 36461e58f88a1b723f86693f437ac12e60ff4363LinuxCVE List
  • 3c1e0a4bc156b8d5c5772dbc76b9ea74dce5ca24LinuxCVE List
  • 70504de0bb627848667207bec7ccfd647deb8814LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

xsk: Use a 32-bit compare in xsk_map_gen_lookup

xsk_map_gen_lookup() loads a u32 key and compares it with max_entries using BPF_JMP_IMM. BPF immediates are sign-extended to 64 bits, so a max_entries value of 0x80000000 or higher becomes a threshold larger than every zero-extended 32-bit key. An out-of-range index then skips the bounds check and the generated lookup reads past xsk_map[].

Compare with BPF_JMP32_IMM so the check stays in 32-bit unsigned range.

Text from CVE List

Affected versions 18

  • Linuxaffected: e65650f291ee72fc578d6346080fc4699204ef2c before c6d5c582d55a8f229d75e98d62eaa065b0deb18dCVE List
  • Linuxaffected: e65650f291ee72fc578d6346080fc4699204ef2c before 227ec890559e922e235eb543646e3bf0bd8269b0CVE List
  • Linuxaffected: e65650f291ee72fc578d6346080fc4699204ef2c before 11d9be35c1f4233798e99be98bc474f83a254c6cCVE List
  • Linuxaffected: e65650f291ee72fc578d6346080fc4699204ef2c before 123f90f394ca404ab8796a7c8072ff7fa5b65a9cCVE List
  • Linuxaffected: e65650f291ee72fc578d6346080fc4699204ef2c before 36461e58f88a1b723f86693f437ac12e60ff4363CVE List
  • Linuxaffected: e65650f291ee72fc578d6346080fc4699204ef2c before b5c0cff0c5331582ab01c4c423731453a8381accCVE List
  • Linuxaffected: e65650f291ee72fc578d6346080fc4699204ef2c before 3c1e0a4bc156b8d5c5772dbc76b9ea74dce5ca24CVE List
  • Linuxaffected: e65650f291ee72fc578d6346080fc4699204ef2c before 70504de0bb627848667207bec7ccfd647deb8814CVE List
  • Linuxaffected: 5.5CVE List
  • Linuxunaffected: all versions before 5.5CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8