{"id":"CVE-2026-98572","kind":"vulnerability","aliases":["CVE-2026-98572"],"related":[],"title":"Linux kernel: BPF jump comparisons on MIPS32 return wrong results","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix immediate JMP JEQ/JNE on MIPS32\n\nAn addu instruction was emitted instead of addiu, causing the immediate\nvalue 1 to be interpreted as register $at. This made the comparison\nresult invalid when the immediate operand was negative. Note that $at\nis mapped to BPF_REG_AX, which is used for constant blinding.\n\nFix the instruction to use the immediate form.\n\nFound with test_bpf on MIPS32r1 emulated by QEMU.","summary":"The Linux kernel's BPF JIT for MIPS32 emitted an addu instruction instead of addiu for immediate JEQ/JNE jumps, so a negative immediate value was compared incorrectly. The sources do not say that an attacker can use this to run code or read data.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bpf","infrastructure","linux-kernel","mips32"],"not_affected_if":["non-mips32-hardware"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:09+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:11+00:00","updated_at":"2026-10-25T05:23:11+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:23:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Linux kernel: BPF jump comparisons on MIPS32 return wrong results","impact":"low","summary":"The Linux kernel's BPF JIT for MIPS32 emitted an addu instruction instead of addiu for immediate JEQ/JNE jumps, so a negative immediate value was compared incorrectly. The sources do not say that an attacker can use this to run code or read data.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","mips32","bpf"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; sources do not describe an attacker impact","analyst_note":"Check the upstream kernel commit and the NVD entry for affected versions, whether unprivileged BPF loading is possible on MIPS32, and what security impact the fix addresses.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["non-mips32-hardware"],"who_is_affected":"Systems running the Linux kernel on MIPS32 with BPF JIT enabled may be affected. The sources do not say which kernel versions are impacted or whether the flaw is reachable by unprivileged users.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000568,"input_tokens":3412,"output_tokens":454,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98572':13A,16A '1':96C 'addiu':37B,91C 'addu':33B,85C 'attack':57B 'ax':123C 'blind':129C 'bpf':3A,17B,27B,77C,121C,141C 'caus':92C 'code':63B 'compar':48B 'comparison':5A,106C 'constant':128C 'cve':11A,14A 'data':66B 'emit':31B,88C 'emul':144C 'fix':78C,130C 'follow':72C 'form':137C 'found':138C 'immedi':39B,45B,79C,94C,111C,136C 'incorrect':49B 'infrastructur':18B 'instead':35B,89C 'instruct':34B,86C,132C 'interpret':99C 'invalid':108C 'jeq/jne':40B,81C 'jit':28B 'jmp':80C 'jump':4A,41B 'kernel':2A,21B,25B,70C 'linux':1A,20B,24B,69C 'linux-kernel':19B 'made':104C 'map':119C 'mips32':7A,22B,30B,83C 'mips32r1':143C 'negat':44B,114C 'note':115C 'operand':112C 'qemu':146C 'read':65B 'reg':122C 'regist':101C 'resolv':76C 'result':10A,107C 'return':8A 'run':62B 'say':54B 'sourc':51B 'test':140C 'use':59B,126C,134C 'valu':46B,95C 'vulner':73C 'wrong':9A","nicknames":[],"mitigations":[],"who_affected":"Systems running the Linux kernel on MIPS32 with BPF JIT enabled may be affected. The sources do not say which kernel versions are impacted or whether the flaw is reachable by unprivileged users.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:09+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98572","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98572","severity":null,"published_at":"2026-10-18T16:17:09+00:00","modified_at":"2026-10-19T10:19:15+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}