Live › vulnerability › CVE-2026-98631
Go to dashboardThe Linux kernel's AF_XDP socket map lookup code compares a 32-bit index against the map size using a sign-extended 64-bit immediate, so a map with 0x80000000 or more entries lets an out-of-range index skip the bounds check. The generated lookup then reads memory past the end of the xsk_map array.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems that load BPF programs that use XSKMAP lookups with very large map sizes are reachable by this path, which in practice means hosts running AF_XDP workloads. The sources do not say which kernel versions are affected or which distributions have shipped fixes, so ordinary hosts that do not use AF_XDP sockets can likely skip urgent action.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel builds listed by the distribution or the upstream commit.bpftool map show listing xskmap entries.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
xsk: Use a 32-bit compare in xsk_map_gen_lookup
xsk_map_gen_lookup() loads a u32 key and compares it with max_entries using BPF_JMP_IMM. BPF immediates are sign-extended to 64 bits, so a max_entries value of 0x80000000 or higher becomes a threshold larger than every zero-extended 32-bit key. An out-of-range index then skips the bounds check and the generated lookup reads past xsk_map[].
Compare with BPF_JMP32_IMM so the check stays in 32-bit unsigned range.
This page as .md · .json · in your agent: get_signal("CVE-2026-98631")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.