SB20260928164 - Always-Incorrect Control Flow Implementation in Linux kernel bpf

Description

This security bulletin contains information about 1 vulnerability.

1) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-98041)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to incorrect branch prediction in the BPF verifier's is_branch_taken function when processing 32-bit BPF jump comparisons between pointers and zero. A local user can load a BPF program containing a 32-bit pointer-versus-zero comparison to compromise confidentiality, integrity, and availability.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/a4d7f94c1ca914469ced665ec2f98be669aef462
• https://git.kernel.org/stable/c/d16f0eafcaa62e677a2b5b0dabc1f8d31dfe3d4d
• https://git.kernel.org/stable/c/e2ae33247e8b2dbe9d116d3e61cadf6d548339c6
• https://git.kernel.org/stable/c/e51179a4e09846f8fd0f26a05068520de2b301bf