Live › vulnerability › CVE-2026-98591
Go to dashboardIn the Linux kernel's BPF subsystem, a bounds check for skb-backed dynptrs can underflow and wrongly pass, producing a pointer into invalid memory. The sources do not say what an attacker can do with the bad pointer beyond this memory misuse.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with BPF dynptr support where BPF programs use skb-backed dynptrs; the sources name no other trigger. Hosts that do not run BPF programs that touch skb-backed dynptrs are likely not exposed, but the sources do not confirm this.
No product ranges from the sources yet.
uname -r to see the running kernel version, then compare it against the fixed kernel release listed in the upstream kernel commit or NVD entryEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix bounds check for skb-backed dynptrs
The skb_pointer_if_linear() function checks whether a memory region of length len starting at offset off into the skb is in the linear area, and returns a pointer to the region if so. The check currently subtracts between skb_headlen and offset of the check, and since skb_headlen is unsigned the subtraction can underflow. This causes the bounds check to spuriously pass and generate an arbitrary pointer of the form *(skb->data + off).
The only user of this helper is currently skb-backed BPF dynptr code. Returning the wrong pointer leads to the dynptr erroneously being backed with invalid memory.
Ensure the subtraction cannot underflow, and fail the check if it would. Use u64 arithmetic to also prevent overflow when calculating (skb_headlen(skb) - off) since off is unsigned.
This page as .md · .json · in your agent: get_signal("CVE-2026-98591")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.