CVE-2026-98591

Received Received - Intake

BPF dynptr Memory Bounds Check Fix in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bounds check for skb-backed dynptrs The skb_pointer_if_linear() function checks whether a memory region of length len starting at offset off into the skb is in the linear area, and returns a pointer to the region if so. The check currently subtracts between skb_headlen and offset of the check, and since skb_headlen is unsigned the subtraction can underflow. This causes the bounds check to spuriously pass and generate an arbitrary pointer of the form *(skb->data + off). The only user of this helper is currently skb-backed BPF dynptr code. Returning the wrong pointer leads to the dynptr erroneously being backed with invalid memory. Ensure the subtraction cannot underflow, and fail the check if it would. Use u64 arithmetic to also prevent overflow when calculating (skb_headlen(skb) - off) since off is unsigned.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98591

EUVD

EUVD-2026-103636

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	6f5a630d7c57cd79b1f526a95e757311e32d41e5
Linux	Linux	6f5a630d7c57cd79b1f526a95e757311e32d41e5
Linux	Linux	6f5a630d7c57cd79b1f526a95e757311e32d41e5
Linux	Linux	6f5a630d7c57cd79b1f526a95e757311e32d41e5
Linux	Linux	6f5a630d7c57cd79b1f526a95e757311e32d41e5
Linux	Linux	6.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a bounds check error in the skb_pointer_if_linear() function. It occurs when calculating memory regions for skb-backed BPF dynptrs. The issue arises from an unsigned integer underflow during subtraction, which can incorrectly pass the bounds check and return an invalid pointer. This leads to the BPF dynptr being backed by invalid memory, potentially causing memory corruption or other undefined behavior.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) subsystem and requires kernel-level inspection. Detection involves checking kernel versions and BPF-related components for the patched code. Use commands like 'uname -a' to check kernel version and 'dmesg | grep BPF' to inspect BPF-related logs. If your kernel version is below the patched version, the system may be vulnerable.

Impact Analysis

If exploited, this vulnerability could allow an attacker to manipulate memory access in the Linux kernel, leading to crashes, privilege escalation, or arbitrary code execution. Systems using BPF dynptrs with skb-backed memory are particularly at risk. Users running vulnerable kernel versions should apply patches to prevent potential security incidents.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level memory access issue in the Linux kernel's BPF subsystem. Compliance impacts would depend on how the affected system is used, not the vulnerability itself.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the bounds check issue in the BPF dynptrs code. Monitor vendor advisories for kernel updates and apply them promptly.

Hi! I’m here to help you understand CVE-2026-98591. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70