CVE-2026-98041

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

• https://git.kernel.org/stable/c/a4d7f94c1ca914469ced665ec2f98be669aef462 416baaa9-dc9f-4396-8d5f-8c081fb06d67
• https://git.kernel.org/stable/c/d16f0eafcaa62e677a2b5b0dabc1f8d31dfe3d4d 416baaa9-dc9f-4396-8d5f-8c081fb06d67
• https://git.kernel.org/stable/c/e2ae33247e8b2dbe9d116d3e61cadf6d548339c6 416baaa9-dc9f-4396-8d5f-8c081fb06d67
• https://git.kernel.org/stable/c/e51179a4e09846f8fd0f26a05068520de2b301bf 416baaa9-dc9f-4396-8d5f-8c081fb06d67

The full cvelistV5 record. Download as CVE-2026-98041.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d16f0eafcaa62e677a2b5b0dabc1f8d31dfe3d4d",
              "status": "affected",
              "version": "cac616db39c207dc63465a4e05c6ce0e60b2cce4",
              "versionType": "git"
            },
            {
              "lessThan": "e2ae33247e8b2dbe9d116d3e61cadf6d548339c6",
              "status": "affected",
              "version": "cac616db39c207dc63465a4e05c6ce0e60b2cce4",
              "versionType": "git"
            },
            {
              "lessThan": "a4d7f94c1ca914469ced665ec2f98be669aef462",
              "status": "affected",
              "version": "cac616db39c207dc63465a4e05c6ce0e60b2cce4",
              "versionType": "git"
            },
            {
              "lessThan": "e51179a4e09846f8fd0f26a05068520de2b301bf",
              "status": "affected",
              "version": "cac616db39c207dc63465a4e05c6ce0e60b2cce4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc2",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Don't predict JMP32 pointer vs zero comparisons\n\nConsider the following program:\n\n        r1 = map_value;      /* low 32 bits are zero at runtime */\n        r6 = 0xdead000000000000;\n        if w1 != 0 goto l1;\n    l0: r1 += r6;\n        r2 = *(u64 *)(r1 + 0);\n        exit;\n    l1: r6 = 0;\n        goto l0;\n\nAt the moment is_branch_taken() reports the jump as always taken,\nbecause it does not distinguish between BPF_JMP and BPF_JMP32\ncomparisons when processing 'if w1 != 0 ...'."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker must load a BPF program locally with bpf(BPF_PROG_LOAD). bpf_check() -> check_cond_jmp_op() -> is_branch_taken() then mispredicts a JMP32 'if wX != 0' on a pointer register. No network peer supplies any of the input.\nAC:H - The fall-through only diverges at runtime when the pointer's low 32 bits happen to be zero. An unprivileged attacker cannot read kernel addresses, so they cannot choose that alignment. That route also needs the non-default setting unprivileged_bpf_disabled=0 and a way past the verifier's unprivileged mitigations.\nPR:L - For JMP32 compares of a pointer against immediate 0, is_branch_taken() runs before the 'pointer comparison prohibited' check, so unprivileged socket-filter programs reach it when kernel.unprivileged_bpf_disabled=0. That setting is non-default on current kernels but was upstream's default on older affected kernels. Otherwise CAP_BPF in init_user_ns is required.\nUI:N - The attacker writes, loads and runs the BPF program themselves, for example by attaching a socket filter to their own socket and sending traffic. No other user has to act.\nS:U - The result is a kernel privilege escalation inside the same kernel security authority. The bug does not cross a VM or hypervisor boundary.\nC:H - Unverified code on the path the verifier thought unreachable can add an arbitrary scalar to a pointer the verifier believes is in bounds, for example the fix commit's r1 += r6 with r6=0xdead000000000000. The following load then reads arbitrary kernel memory.\nI:H - The same out-of-bounds pointer can be used as the target of a store, so the bypass gives an arbitrary kernel write and a path to code execution or credential overwrite.\nA:H - Dereferencing the wild pointer on the mispredicted path, such as 0xdead000000000000 in the commit's reproducer, oopses or panics the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:41:55.951Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d16f0eafcaa62e677a2b5b0dabc1f8d31dfe3d4d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2ae33247e8b2dbe9d116d3e61cadf6d548339c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4d7f94c1ca914469ced665ec2f98be669aef462"
        },
        {
          "url": "https://git.kernel.org/stable/c/e51179a4e09846f8fd0f26a05068520de2b301bf"
        }
      ],
      "title": "bpf: Don't predict JMP32 pointer vs zero comparisons",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98041",
    "datePublished": "2026-09-25T10:23:53.619Z",
    "dateReserved": "2026-09-25T10:19:56.071Z",
    "dateUpdated": "2026-09-25T14:41:55.951Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}