Incorrect calculation in Linux kernel - CVE-2026-98869
Published: October 22, 2026
Vulnerability identifier: #VU156729
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98869
CWE-ID: CWE-682
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to inject arbitrary values into the upper halves of BPF registers, violating the verifier's assumptions about program execution.
The vulnerability exists due to incorrect tracking of register liveness and required zero extension in the Linux kernel BPF verifier when processing 32-bit operations across verification paths that converge at a checkpoint. A local user can submit a specially crafted BPF program to cause required zero extension to be omitted on s390, allowing arbitrary upper-register values to persist where the verifier expects zeros.
Affected software
Linux kernel
How to mitigate CVE-2026-98869
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3