---
id: "CVE-2026-98591"
kind: "vulnerability"
aliases: ["CVE-2026-98591"]
title: "Linux kernel: BPF skb dynptr bounds check underflow yields invalid pointer"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["bpf", "infrastructure", "linux-kernel", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-18T16:17:11+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T05:21:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98591", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# Linux kernel: BPF skb dynptr bounds check underflow yields invalid pointer

In the Linux kernel's BPF subsystem, a bounds check for skb-backed dynptrs can underflow and wrongly pass, producing a pointer into invalid memory. The sources do not say what an attacker can do with the bad pointer beyond this memory misuse.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` to see the running kernel version, then compare it against the fixed kernel release listed in the upstream kernel commit or NVD entry
- unknown whether the sources name a specific affected version range

## Fix

- Update the Linux kernel to a release that includes the upstream fix for the skb_pointer_if_linear bounds check (unknown exact version in the sources)

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98591

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix bounds check for skb-backed dynptrs

The skb_pointer_if_linear() function checks whether a
memory region of length len starting at offset off into
the skb is in the linear area, and returns a pointer to
the region if so. The check currently subtracts between
skb_headlen and offset of the check, and since skb_headlen
is unsigned the subtraction can underflow. This causes the
bounds check to spuriously pass and generate an arbitrary
pointer of the form *(skb->data + off).

The only user of this helper is currently skb-backed BPF
dynptr code. Returning the wrong pointer leads to the
dynptr erroneously being backed with invalid memory.

Ensure the subtraction cannot underflow, and fail the check if
it would. Use u64 arithmetic to also prevent overflow when
calculating (skb_headlen(skb) - off) since off is unsigned.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_