CVE-2026-98816

Received Received - Intake

BPF Jump Offset Overflow in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overflow of jump offset in constant blinding bpf_jit_blind_insn() rewrites 'if rX op imm goto off' into: AX = imm ^ rnd AX ^= rnd if rX op AX goto off and subtracts 2 from off when the jump is backward. off is s16, so -32767 and -32768 wrap and the jump goes 32767 insns forward, past the end of the prog. The jump is inside the patch, hence bpf_adj_branches() doesn't check it. The kernel crashes when such prog runs with bpf_jit_harden=2. Return -ERANGE in such case. bpf_jit_blind_constants() fails the same way when blinding of other insns moves a jump out of range.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98816

EUVD

EUVD-2026-103901

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	4f3446bb809f20ad56cadf712e6006815ae7a8f9
Linux	Linux	4f3446bb809f20ad56cadf712e6006815ae7a8f9
Linux	Linux	4.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves an overflow in the jump offset during constant blinding in the BPF (Berkeley Packet Filter) JIT compiler. The issue occurs when rewriting conditional jumps, causing backward jumps to wrap around and go forward instead, potentially leading to out-of-bounds execution and kernel crashes when bpf_jit_harden=2 is enabled.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) implementation and requires kernel-level inspection. Detection involves checking kernel logs for crashes or errors related to BPF constant blinding. Use commands like 'dmesg | grep -i bpf' or 'journalctl -k | grep -i bpf' to search for relevant errors. Ensure your kernel version is updated to a patched version.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code in the kernel, leading to system crashes or privilege escalation. Systems using BPF with constant blinding enabled may be affected, especially if bpf_jit_harden=2 is set.

Compliance Impact

This vulnerability affects compliance with standards and regulations like GDPR and HIPAA by potentially causing kernel crashes in systems running the Linux kernel with bpf_jit_harden=2. Such crashes could lead to unauthorized access, data breaches, or loss of availability, which are critical concerns under GDPR and HIPAA.

Mitigation Strategies

Immediately update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If updating is not immediately possible, disable BPF JIT hardening by setting 'bpf_jit_harden=0' in kernel parameters as a temporary workaround. Monitor kernel logs for any signs of exploitation or crashes.

Hi! I’m here to help you understand CVE-2026-98816. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70