SB20260812251 - Incorrect calculation in Linux kernel loongarch net

Description

This security bulletin contains information about 1 vulnerability.

1) Incorrect calculation (CVE-ID: CVE-2026-68295)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect BPF program execution.

The vulnerability exists due to improper handling of integer extension in the LoongArch BPF JIT compiler when processing signed ALU32 divide and modulo operations. A local user can load a crafted BPF program to cause incorrect BPF program execution.

The issue arises because signed ALU32 division and modulo results are sign-extended in JITted code while the verifier and interpreter model the upper 32 bits as zero.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/716cb29dbed4d62e9e108950a1a82bcba4cc2d45
• https://git.kernel.org/stable/c/dacd348b8a993373576fe2ee2d8b114740ba57a6