{"id":"CVE-2026-98591","kind":"vulnerability","aliases":["CVE-2026-98591"],"related":[],"title":"Linux kernel: BPF skb dynptr bounds check underflow yields invalid pointer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix bounds check for skb-backed dynptrs\n\nThe skb_pointer_if_linear() function checks whether a\nmemory region of length len starting at offset off into\nthe skb is in the linear area, and returns a pointer to\nthe region if so. The check currently subtracts between\nskb_headlen and offset of the check, and since skb_headlen\nis unsigned the subtraction can underflow. This causes the\nbounds check to spuriously pass and generate an arbitrary\npointer of the form *(skb->data + off).\n\nThe only user of this helper is currently skb-backed BPF\ndynptr code. Returning the wrong pointer leads to the\ndynptr erroneously being backed with invalid memory.\n\nEnsure the subtraction cannot underflow, and fail the check if\nit would. Use u64 arithmetic to also prevent overflow when\ncalculating (skb_headlen(skb) - off) since off is unsigned.","summary":"In the Linux kernel's BPF subsystem, a bounds check for skb-backed dynptrs can underflow and wrongly pass, producing a pointer into invalid memory. The sources do not say what an attacker can do with the bad pointer beyond this memory misuse.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bpf","infrastructure","linux-kernel","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- `uname -r` to see the running kernel version, then compare it against the fixed kernel release listed in the upstream kernel commit or NVD entry\n- unknown whether the sources name a specific affected version range","fix":"- Update the Linux kernel to a release that includes the upstream fix for the skb_pointer_if_linear bounds check (unknown exact version in the sources)","status":"open","published_at":"2026-10-18T16:17:11+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:21:42+00:00","updated_at":"2026-10-25T05:21:42+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:21:42Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for the skb_pointer_if_linear bounds check (unknown exact version in the sources)","reach":"unknown","title":"Linux kernel: BPF skb dynptr bounds check underflow yields invalid pointer","impact":"high","summary":"In the Linux kernel's BPF subsystem, a bounds check for skb-backed dynptrs can underflow and wrongly pass, producing a pointer into invalid memory. The sources do not say what an attacker can do with the bad pointer beyond this memory misuse.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","bpf","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"invalid kernel memory is referenced through a BPF dynptr","analyst_note":"Check the upstream kernel commit or NVD entry for affected version ranges, the fixed release, and whether an unprivileged user can load BPF programs that reach this path.","how_to_check":"- `uname -r` to see the running kernel version, then compare it against the fixed kernel release listed in the upstream kernel commit or NVD entry\n- unknown whether the sources name a specific affected version range","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Systems running a Linux kernel with BPF dynptr support where BPF programs use skb-backed dynptrs; the sources name no other trigger. Hosts that do not run BPF programs that touch skb-backed dynptrs are likely not exposed, but the sources do not confirm this.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00065,"input_tokens":3541,"output_tokens":592,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98591':14A,17A 'also':209C 'arbitrari':157C 'area':114C 'arithmet':207C 'attack':59B 'back':39B,87C,175C,189C 'bad':64B 'beyond':66B 'bound':6A,34B,82C,149C 'bpf':3A,18B,31B,80C,176C 'calcul':213C 'cannot':196C 'caus':147C 'check':7A,35B,83C,95C,125C,135C,150C,201C 'code':178C 'current':126C,172C 'cve':12A,15A 'data':163C 'dynptr':5A,40B,88C,177C,186C 'ensur':193C 'erron':187C 'fail':199C 'fix':81C 'follow':75C 'form':161C 'function':94C 'generat':155C 'headlen':130C,139C,215C 'helper':170C 'host':25B 'infrastructur':19B 'invalid':10A,50B,191C 'kernel':2A,22B,29B,73C 'lead':183C 'len':102C 'length':101C 'linear':93C,113C 'linux':1A,21B,28B,72C 'linux-kernel':20B 'memori':51B,68B,98C,192C 'misus':69B 'offset':105C,132C 'overflow':211C 'pass':45B,153C 'pointer':11A,48B,65B,91C,118C,158C,182C 'prevent':210C 'produc':46B 'region':99C,121C 'resolv':79C 'return':116C,179C 'say':56B 'self':24B 'self-host':23B 'sinc':137C,218C 'skb':4A,38B,86C,90C,109C,129C,138C,162C,174C,214C,216C 'skb-back':37B,85C,173C 'sourc':53B 'spurious':152C 'start':103C 'subsystem':32B 'subtract':127C,143C,195C 'u64':206C 'underflow':8A,42B,145C,197C 'unsign':141C,221C 'use':205C 'user':167C 'vulner':76C 'whether':96C 'would':204C 'wrong':44B,181C 'yield':9A","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with BPF dynptr support where BPF programs use skb-backed dynptrs; the sources name no other trigger. Hosts that do not run BPF programs that touch skb-backed dynptrs are likely not exposed, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98591","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98591","severity":null,"published_at":"2026-10-18T16:17:11+00:00","modified_at":"2026-10-19T10:19:20+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}