CVE-2026-98591
Received Received - Intake

BPF dynptr Memory Bounds Check Fix in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bounds check for skb-backed dynptrs The skb_pointer_if_linear() function checks whether a memory region of length len starting at offset off into the skb is in the linear area, and returns a pointer to the region if so. The check currently subtracts between skb_headlen and offset of the check, and since skb_headlen is unsigned the subtraction can underflow. This causes the bounds check to spuriously pass and generate an arbitrary pointer of the form *(skb->data + off). The only user of this helper is currently skb-backed BPF dynptr code. Returning the wrong pointer leads to the dynptr erroneously being backed with invalid memory. Ensure the subtraction cannot underflow, and fail the check if it would. Use u64 arithmetic to also prevent overflow when calculating (skb_headlen(skb) - off) since off is unsigned.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98591
EUVD
EUVD-2026-103636

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
Linux Linux 6f5a630d7c57cd79b1f526a95e757311e32d41e5
Linux Linux 6f5a630d7c57cd79b1f526a95e757311e32d41e5
Linux Linux 6f5a630d7c57cd79b1f526a95e757311e32d41e5
Linux Linux 6f5a630d7c57cd79b1f526a95e757311e32d41e5
Linux Linux 6f5a630d7c57cd79b1f526a95e757311e32d41e5
Linux Linux 6.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a bounds check error in the skb_pointer_if_linear() function. It occurs when calculating memory regions for skb-backed BPF dynptrs. The issue arises from an unsigned integer underflow during subtraction, which can incorrectly pass the bounds check and return an invalid pointer. This leads to the BPF dynptr being backed by invalid memory, potentially causing memory corruption or other undefined behavior.

Impact Analysis

If exploited, this vulnerability could allow an attacker to manipulate memory access in the Linux kernel, leading to crashes, privilege escalation, or arbitrary code execution. Systems using BPF dynptrs with skb-backed memory are particularly at risk. Users running vulnerable kernel versions should apply patches to prevent potential security incidents.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the bounds check issue in the BPF dynptrs code. Monitor vendor advisories for kernel updates and apply them promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98591. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart