CVE-2026-98590

Received Received - Intake

Linux Kernel BPF Sock Context Code Generation Vulnerability

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpf_sock context code generation Currently, the ctx access code reads the rx_queue_mapping field with either a 4-byte or 2-byte load. The rest of the bits in the register are marked known zero by the verifier. However, the emitted ctx access code places in the register on certain the special value (-1) using BPF_MOV_IMM64, which gets sign-extended to turn on all the bits in the register. By shifting this value right, the program ends up with a value at runtime above what the verifier assumes is possible. Fix this by ensuring the read value is as wide as the assumed size. Use MOV32 instructions instead of MOV64 instructions to keep the upper bits zero as assumed by the verifier. Also properly report the size of the destination variable (the bpf_sock field, 4 bytes) instead of the source (the socket field, 2 bytes).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98590

EUVD

EUVD-2026-103635

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	c3c16f2ea6d20159903cf93afbb1155f3d8348d5
Linux	Linux	c3c16f2ea6d20159903cf93afbb1155f3d8348d5
Linux	Linux	c3c16f2ea6d20159903cf93afbb1155f3d8348d5
Linux	Linux	c3c16f2ea6d20159903cf93afbb1155f3d8348d5
Linux	Linux	c3c16f2ea6d20159903cf93afbb1155f3d8348d5
Linux	Linux	c3c16f2ea6d20159903cf93afbb1155f3d8348d5
Linux	Linux	c3c16f2ea6d20159903cf93afbb1155f3d8348d5
Linux	Linux	c3c16f2ea6d20159903cf93afbb1155f3d8348d5
Linux	Linux	5.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves incorrect code generation for accessing the bpf_sock context. The issue occurs when the verifier assumes certain bits in a register are zero after reading a field, but the emitted code sets those bits to 1 due to sign-extension. This can lead to unexpected values during runtime that bypass the verifier's assumptions.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) implementation and requires kernel-level inspection. Detection involves checking kernel version and BPF-related components for the affected code paths. Use commands like 'uname -a' to check kernel version and 'dmesg | grep -i bpf' to look for BPF-related errors or warnings.

Impact Analysis

This vulnerability could allow a local attacker to escalate privileges or execute arbitrary code in the kernel context. It may also lead to denial-of-service conditions by crashing the system or causing instability.

Compliance Impact

This vulnerability affects compliance with standards and regulations like GDPR and HIPAA by potentially enabling unauthorized access to sensitive data through improper handling of bpf_sock context in the Linux kernel. Exploitation could lead to data leaks or integrity violations, which are critical concerns under these regulations.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the bpf_sock context code generation issue. Monitor vendor advisories for kernel updates and apply them promptly.

Hi! I’m here to help you understand CVE-2026-98590. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70