CVE-2026-98631xsk: Use a 32-bit compare in xsk_map_gen_lookup
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: xsk: Use a 32-bit compare in xsk_map_gen_lookup xsk_map_gen_lookup() loads a u32 key and compares it with max_entries using BPF_JMP_IMM. BPF immediates are sign-extended to 64 bits, so a max_entries value of 0x80000000 or higher becomes a threshold larger than every zero-extended 32-bit key. An out-of-range index then skips the bounds check and the generated lookup reads past xsk_map[]. Compare with BPF_JMP32_IMM so the check stays in 32-bit unsigned range.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from e65650f291ee72fc578d6346080fc4699204ef2c before c6d5c582d55a8f229d75e98d62eaa065b0deb18d; from e65650f291ee72fc578d6346080fc4699204ef2c before 227ec890559e922e235eb543646e3bf0bd8269b0; from e65650f291ee72fc578d6346080fc4699204ef2c before 11d9be35c1f4233798e99be98bc474f83a254c6c; from e65650f291ee72fc578d6346080fc4699204ef2c before 123f90f394ca404ab8796a7c8072ff7fa5b65a9c; from e65650f291ee72fc578d6346080fc4699204ef2c before 36461e58f88a1b723f86693f437ac12e60ff4363; from e65650f291ee72fc578d6346080fc4699204ef2c before b5c0cff0c5331582ab01c4c423731453a8381acc; from e65650f291ee72fc578d6346080fc4699204ef2c before 3c1e0a4bc156b8d5c5772dbc76b9ea74dce5ca24; from e65650f291ee72fc578d6346080fc4699204ef2c before 70504de0bb627848667207bec7ccfd647deb8814 | CNA record |
References
- https://git.kernel.org/stable/c/c6d5c582d55a8f229d75e98d62eaa065b0deb18d
- https://git.kernel.org/stable/c/227ec890559e922e235eb543646e3bf0bd8269b0
- https://git.kernel.org/stable/c/11d9be35c1f4233798e99be98bc474f83a254c6c
- https://git.kernel.org/stable/c/123f90f394ca404ab8796a7c8072ff7fa5b65a9c
- https://git.kernel.org/stable/c/36461e58f88a1b723f86693f437ac12e60ff4363
- https://git.kernel.org/stable/c/b5c0cff0c5331582ab01c4c423731453a8381acc
- https://git.kernel.org/stable/c/3c1e0a4bc156b8d5c5772dbc76b9ea74dce5ca24
- https://git.kernel.org/stable/c/70504de0bb627848667207bec7ccfd647deb8814
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.