SB20261022149 - Incorrect comparison in Linux kernel mips net

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261022149

SB20261022149 - Incorrect comparison in Linux kernel mips net

Published: October 22, 2026

Security Bulletin ID SB20261022149
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Incorrect comparison (CVE-ID: CVE-2026-98572)

CWE-ID: CWE-697 - Incorrect Comparison

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause incorrect BPF comparison results and unintended BPF program control flow on MIPS32 systems.

The vulnerability exists due to incorrect instruction emission in the Linux kernel MIPS32 BPF JIT compiler when compiling immediate JMP JEQ/JNE comparisons with negative operands. A local user can trigger execution of BPF code containing these comparisons to cause incorrect branch decisions because an addu instruction interprets the value 1 as register $at rather than as an immediate constant.


Remediation

Install update from vendor's website.

References