CVE-2026-98041
Received Received - Intake

Improper Branch Prediction in Linux Kernel BPF

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Don't predict JMP32 pointer vs zero comparisons Consider the following program: r1 = map_value; /* low 32 bits are zero at runtime */ r6 = 0xdead000000000000; if w1 != 0 goto l1; l0: r1 += r6; r2 = *(u64 *)(r1 + 0); exit; l1: r6 = 0; goto l0; At the moment is_branch_taken() reports the jump as always taken, because it does not distinguish between BPF_JMP and BPF_JMP32 comparisons when processing 'if w1 != 0 ...'.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98041
EUVD
EUVD-2026-86694

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect branch prediction in BPF (Berkeley Packet Filter) JMP32 instructions. The issue occurs when comparing a 32-bit register value to zero. The kernel's branch predictor treats BPF_JMP and BPF_JMP32 comparisons the same, leading to incorrect assumptions about whether a jump will be taken. This can result in improper execution flow in BPF programs.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) implementation and requires kernel-level inspection. Detection involves checking kernel version and BPF-related configurations. Use commands like 'uname -r' to check kernel version and 'lsmod | grep bpf' to verify BPF module status. No direct network detection commands are applicable.

Impact Analysis

This vulnerability could allow an attacker with the ability to load crafted BPF programs to potentially execute arbitrary code or cause a denial of service in the Linux kernel. It may lead to unexpected behavior in systems using BPF for packet filtering, tracing, or other purposes.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this BPF JMP32 vulnerability. Monitor kernel security advisories and apply patches promptly. If BPF is not actively used, consider disabling BPF modules via kernel configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98041. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart