CVE-2026-98041bpf: Don't predict JMP32 pointer vs zero comparisons
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: bpf: Don't predict JMP32 pointer vs zero comparisons Consider the following program: r1 = map_value; /* low 32 bits are zero at runtime */ r6 = 0xdead000000000000; if w1 != 0 goto l1; l0: r1 += r6; r2 = *(u64 *)(r1 + 0); exit; l1: r6 = 0; goto l0; At the moment is_branch_taken() reports the jump as always taken, because it does not distinguish between BPF_JMP and BPF_JMP32 comparisons when processing 'if w1 != 0 ...'.
- CVSS
- 7.0 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 25, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from cac616db39c207dc63465a4e05c6ce0e60b2cce4 before d16f0eafcaa62e677a2b5b0dabc1f8d31dfe3d4d; from cac616db39c207dc63465a4e05c6ce0e60b2cce4 before e2ae33247e8b2dbe9d116d3e61cadf6d548339c6; from cac616db39c207dc63465a4e05c6ce0e60b2cce4 before a4d7f94c1ca914469ced665ec2f98be669aef462; from cac616db39c207dc63465a4e05c6ce0e60b2cce4 before e51179a4e09846f8fd0f26a05068520de2b301bf | CNA record |
References
- https://git.kernel.org/stable/c/d16f0eafcaa62e677a2b5b0dabc1f8d31dfe3d4d
- https://git.kernel.org/stable/c/e2ae33247e8b2dbe9d116d3e61cadf6d548339c6
- https://git.kernel.org/stable/c/a4d7f94c1ca914469ced665ec2f98be669aef462
- https://git.kernel.org/stable/c/e51179a4e09846f8fd0f26a05068520de2b301bf
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.