All vulnerabilities
CVE-2026-98816

Linux: bpf: Fix overflow of jump offset in constant blinding

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in443328237113ee0ea515e506497334d871dbc2aaFixed versionCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 443328237113ee0ea515e506497334d871dbc2aaLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix overflow of jump offset in constant blinding

bpf_jit_blind_insn() rewrites 'if rX op imm goto off' into:

AX = imm ^ rnd AX ^= rnd if rX op AX goto off

and subtracts 2 from off when the jump is backward. off is s16, so -32767 and -32768 wrap and the jump goes 32767 insns forward, past the end of the prog. The jump is inside the patch, hence bpf_adj_branches() doesn't check it. The kernel crashes when such prog runs with bpf_jit_harden=2.

Return -ERANGE in such case. bpf_jit_blind_constants() fails the same way when blinding of other insns moves a jump out of range.

Text from CVE List

Affected versions 6

  • Linuxaffected: 4f3446bb809f20ad56cadf712e6006815ae7a8f9 before 443328237113ee0ea515e506497334d871dbc2aaCVE List
  • Linuxaffected: 4f3446bb809f20ad56cadf712e6006815ae7a8f9 before ad139384ecddb6f3e7e3c3c12765aafae0e39670CVE List
  • Linuxaffected: 4.7CVE List
  • Linuxunaffected: all versions before 4.7CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 2