CVE-2026-98856kprobes: Skip disarmed probes when checking optkprobe overlap
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: kprobes: Skip disarmed probes when checking optkprobe overlap On x86, an optkprobe at A replaces five bytes with a jump. If a disabled probe B is at A+2, get_optimized_kprobe() stops at B when arming a new probe C at A+4. It leaves A optimized: A A+1 A+2 A+3 A+4 A's jump | e9 | d0 | d1 | d2 | d3 | after C | e9 | d0 | d1 | d2 | cc | The INT3 for C overwrites the last byte of A's jump displacement, so execution can jump to the wrong address. B can have prepared optinsns while disarmed, but has no jump to unoptimize. Continue past disarmed and unprepared probes to find the active optimized probe before arming a probe in its jump.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from afd66255b9a48f5851326ddae50e2203fbf71dc9 before 985a568171e7bdba6dcde3420d0e5bb515813457; from afd66255b9a48f5851326ddae50e2203fbf71dc9 before 6745fa65f4115045431c0c15610e876855a04625; from afd66255b9a48f5851326ddae50e2203fbf71dc9 before 526fac219e8b7d3369b43026bd0a1df51b811cd4; from afd66255b9a48f5851326ddae50e2203fbf71dc9 before 7a39c732a22ec4a369af9e19fbe3d666ec83eec4 | CNA record |
References
- https://git.kernel.org/stable/c/985a568171e7bdba6dcde3420d0e5bb515813457
- https://git.kernel.org/stable/c/6745fa65f4115045431c0c15610e876855a04625
- https://git.kernel.org/stable/c/526fac219e8b7d3369b43026bd0a1df51b811cd4
- https://git.kernel.org/stable/c/7a39c732a22ec4a369af9e19fbe3d666ec83eec4
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.