CVE-2026-98042
Received Received - Intake

BPF Scalar ID Resurrection in Linux Kernel

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Don't resurrect a scalar id dropped by collect_linked_regs() check_cond_jmp_op() copies the compared registers into env->{false,true}_reg{1,2} before collect_linked_regs() runs and copies those snapshots back into both branch states afterwards. collect_linked_regs() records at most LINKED_REGS_MAX members of a linked registers group in the jump history and calls clear_scalar_id() for every member that does not fit. The compared register is not exempt from that. As a consequence, sync_linked_regs() might adjust ranges for more registers than bpf_bt_sync_linked_regs() can propagate precision to. Collect the linked registers before the snapshots are taken instead. This might lead to some unnecessary clear_scalar_id's, but from previous testing situations with many linked registers are extremely rare.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98042
EUVD
EUVD-2026-86695

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect handling of register states during branch prediction in BPF (Berkeley Packet Filter) code. The issue occurs when check_cond_jmp_op() copies compared registers before collect_linked_regs() runs, which may later clear scalar IDs incorrectly. This can lead to inconsistent register precision tracking between branch states.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) component. Detection requires checking the kernel version and BPF-related logs or errors. Use commands like 'uname -a' to check the kernel version and 'dmesg | grep -i bpf' to look for BPF-related errors.

Impact Analysis

This vulnerability could potentially cause incorrect behavior in BPF programs, leading to unexpected packet filtering or security policy enforcement. In severe cases, it might result in kernel crashes or privilege escalation if exploited maliciously.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. Monitor kernel updates from your distribution vendor and apply patches promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98042. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart