SB20260928154 - Incorrect Conversion between Numeric Types in Linux kernel bpf

Description

This security bulletin contains information about 1 vulnerability.

1) Incorrect Conversion between Numeric Types (CVE-ID: CVE-2026-98049)

CWE-ID: CWE-681 - Incorrect Conversion between Numeric Types

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to produce incorrect 32-bit compare-and-exchange results.

The vulnerability exists due to incorrect numeric conversion in the BPF cmpxchg instruction detection logic when executing a BPF program that performs a 32-bit compare-and-exchange on an arena pointer. A local user can execute a BPF program containing the affected operation to produce incorrect 32-bit compare-and-exchange results.

The issue is relevant on architectures where 32-bit compare-and-exchange operations require explicit zero extension of the destination register.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1c1b476d43a8b6c9bc04600369dd8cc39950d98e
• https://git.kernel.org/stable/c/4814ed6406f3493bd554ad046da5f7fc04833571