Vulnerability-Lookup

GHSA-2HHX-GJ64-2962

Vulnerability from github – Published: 2026-09-25 12:31 – Updated: 2026-09-25 15:31

Details

In the Linux kernel, the following vulnerability has been resolved:

bpf: Don't predict JMP32 pointer vs zero comparisons

Consider the following program:

    r1 = map_value;      /* low 32 bits are zero at runtime */
    r6 = 0xdead000000000000;
    if w1 != 0 goto l1;
l0: r1 += r6;
    r2 = *(u64 *)(r1 + 0);
    exit;
l1: r6 = 0;
    goto l0;

At the moment is_branch_taken() reports the jump as always taken, because it does not distinguish between BPF_JMP and BPF_JMP32 comparisons when processing 'if w1 != 0 ...'.

Severity

7.0 (High)


                  
                    CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-98041"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-25T11:17:32Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Don\u0027t predict JMP32 pointer vs zero comparisons\n\nConsider the following program:\n\n        r1 = map_value;      /* low 32 bits are zero at runtime */\n        r6 = 0xdead000000000000;\n        if w1 != 0 goto l1;\n    l0: r1 += r6;\n        r2 = *(u64 *)(r1 + 0);\n        exit;\n    l1: r6 = 0;\n        goto l0;\n\nAt the moment is_branch_taken() reports the jump as always taken,\nbecause it does not distinguish between BPF_JMP and BPF_JMP32\ncomparisons when processing \u0027if w1 != 0 ...\u0027.",
  "id": "GHSA-2hhx-gj64-2962",
  "modified": "2026-09-25T15:31:44Z",
  "published": "2026-09-25T12:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98041"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a4d7f94c1ca914469ced665ec2f98be669aef462"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d16f0eafcaa62e677a2b5b0dabc1f8d31dfe3d4d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e2ae33247e8b2dbe9d116d3e61cadf6d548339c6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e51179a4e09846f8fd0f26a05068520de2b301bf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-98041 (GCVE-0-2026-98041)

Vulnerability from cvelistv5 – Published: 2026-09-25 10:23 – Updated: 2026-09-25 14:41

Title

bpf: Don't predict JMP32 pointer vs zero comparisons

Summary

In the Linux kernel, the following vulnerability has been resolved: bpf: Don't predict JMP32 pointer vs zero comparisons Consider the following program: r1 = map_value; /* low 32 bits are zero at runtime */ r6 = 0xdead000000000000; if w1 != 0 goto l1; l0: r1 += r6; r2 = *(u64 *)(r1 + 0); exit; l1: r6 = 0; goto l0; At the moment is_branch_taken() reports the jump as always taken, because it does not distinguish between BPF_JMP and BPF_JMP32 comparisons when processing 'if w1 != 0 ...'.

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/d16f0eafcaa62e677…
https://git.kernel.org/stable/c/e2ae33247e8b2dbe9…
https://git.kernel.org/stable/c/a4d7f94c1ca914469…
https://git.kernel.org/stable/c/e51179a4e09846f8f…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: cac616db39c207dc63465a4e05c6ce0e60b2cce4 , < d16f0eafcaa62e677a2b5b0dabc1f8d31dfe3d4d (git) Affected: cac616db39c207dc63465a4e05c6ce0e60b2cce4 , < e2ae33247e8b2dbe9d116d3e61cadf6d548339c6 (git) Affected: cac616db39c207dc63465a4e05c6ce0e60b2cce4 , < a4d7f94c1ca914469ced665ec2f98be669aef462 (git) Affected: cac616db39c207dc63465a4e05c6ce0e60b2cce4 , < e51179a4e09846f8fd0f26a05068520de2b301bf (git)
Linux	Linux	Affected: 5.8 Unaffected: 0 , < 5.8 (semver) Unaffected: 6.12.111 , ≤ 6.12.* (semver) Unaffected: 6.18.53 , ≤ 6.18.* (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d16f0eafcaa62e677a2b5b0dabc1f8d31dfe3d4d",
              "status": "affected",
              "version": "cac616db39c207dc63465a4e05c6ce0e60b2cce4",
              "versionType": "git"
            },
            {
              "lessThan": "e2ae33247e8b2dbe9d116d3e61cadf6d548339c6",
              "status": "affected",
              "version": "cac616db39c207dc63465a4e05c6ce0e60b2cce4",
              "versionType": "git"
            },
            {
              "lessThan": "a4d7f94c1ca914469ced665ec2f98be669aef462",
              "status": "affected",
              "version": "cac616db39c207dc63465a4e05c6ce0e60b2cce4",
              "versionType": "git"
            },
            {
              "lessThan": "e51179a4e09846f8fd0f26a05068520de2b301bf",
              "status": "affected",
              "version": "cac616db39c207dc63465a4e05c6ce0e60b2cce4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc2",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Don\u0027t predict JMP32 pointer vs zero comparisons\n\nConsider the following program:\n\n        r1 = map_value;      /* low 32 bits are zero at runtime */\n        r6 = 0xdead000000000000;\n        if w1 != 0 goto l1;\n    l0: r1 += r6;\n        r2 = *(u64 *)(r1 + 0);\n        exit;\n    l1: r6 = 0;\n        goto l0;\n\nAt the moment is_branch_taken() reports the jump as always taken,\nbecause it does not distinguish between BPF_JMP and BPF_JMP32\ncomparisons when processing \u0027if w1 != 0 ...\u0027."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker must load a BPF program locally with bpf(BPF_PROG_LOAD). bpf_check() -\u003e check_cond_jmp_op() -\u003e is_branch_taken() then mispredicts a JMP32 \u0027if wX != 0\u0027 on a pointer register. No network peer supplies any of the input.\nAC:H - The fall-through only diverges at runtime when the pointer\u0027s low 32 bits happen to be zero. An unprivileged attacker cannot read kernel addresses, so they cannot choose that alignment. That route also needs the non-default setting unprivileged_bpf_disabled=0 and a way past the verifier\u0027s unprivileged mitigations.\nPR:L - For JMP32 compares of a pointer against immediate 0, is_branch_taken() runs before the \u0027pointer comparison prohibited\u0027 check, so unprivileged socket-filter programs reach it when kernel.unprivileged_bpf_disabled=0. That setting is non-default on current kernels but was upstream\u0027s default on older affected kernels. Otherwise CAP_BPF in init_user_ns is required.\nUI:N - The attacker writes, loads and runs the BPF program themselves, for example by attaching a socket filter to their own socket and sending traffic. No other user has to act.\nS:U - The result is a kernel privilege escalation inside the same kernel security authority. The bug does not cross a VM or hypervisor boundary.\nC:H - Unverified code on the path the verifier thought unreachable can add an arbitrary scalar to a pointer the verifier believes is in bounds, for example the fix commit\u0027s r1 += r6 with r6=0xdead000000000000. The following load then reads arbitrary kernel memory.\nI:H - The same out-of-bounds pointer can be used as the target of a store, so the bypass gives an arbitrary kernel write and a path to code execution or credential overwrite.\nA:H - Dereferencing the wild pointer on the mispredicted path, such as 0xdead000000000000 in the commit\u0027s reproducer, oopses or panics the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:41:55.951Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d16f0eafcaa62e677a2b5b0dabc1f8d31dfe3d4d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2ae33247e8b2dbe9d116d3e61cadf6d548339c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4d7f94c1ca914469ced665ec2f98be669aef462"
        },
        {
          "url": "https://git.kernel.org/stable/c/e51179a4e09846f8fd0f26a05068520de2b301bf"
        }
      ],
      "title": "bpf: Don\u0027t predict JMP32 pointer vs zero comparisons",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98041",
    "datePublished": "2026-09-25T10:23:53.619Z",
    "dateReserved": "2026-09-25T10:19:56.071Z",
    "dateUpdated": "2026-09-25T14:41:55.951Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-2HHX-GJ64-2962

CVE-2026-98041 (GCVE-0-2026-98041)

Tags

Sightings

Nomenclature

Related by attack behaviour