Incorrect calculation in Linux kernel - CVE-2026-68295
Published: August 12, 2026
Vulnerability identifier: #VU142023
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-68295
CWE-ID: CWE-682
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause incorrect BPF program execution.
The vulnerability exists due to improper handling of integer extension in the LoongArch BPF JIT compiler when processing signed ALU32 divide and modulo operations. A local user can load a crafted BPF program to cause incorrect BPF program execution.
The issue arises because signed ALU32 division and modulo results are sign-extended in JITted code while the verifier and interpreter model the upper 32 bits as zero.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-68295
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.115-2
linux (Debian package) - update to 6.12.115-2