{"id":"CVE-2026-98631","kind":"vulnerability","aliases":["CVE-2026-98631"],"related":[],"title":"Linux kernel: AF_XDP map lookup skips bounds check, reads past array","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: Use a 32-bit compare in xsk_map_gen_lookup\n\nxsk_map_gen_lookup() loads a u32 key and compares it with max_entries\nusing BPF_JMP_IMM. BPF immediates are sign-extended to 64 bits, so a\nmax_entries value of 0x80000000 or higher becomes a threshold larger\nthan every zero-extended 32-bit key. An out-of-range index then skips\nthe bounds check and the generated lookup reads past xsk_map[].\n\nCompare with BPF_JMP32_IMM so the check stays in 32-bit unsigned range.","summary":"The Linux kernel's AF_XDP socket map lookup code compares a 32-bit index against the map size using a sign-extended 64-bit immediate, so a map with 0x80000000 or more entries lets an out-of-range index skip the bounds check. The generated lookup then reads memory past the end of the xsk_map array.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["af-xdp","bpf","infrastructure","kernel","linux","self-hosted"],"not_affected_if":["no-af-xdp","no-xskmap"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel builds listed by the distribution or the upstream commit.\n- Check whether AF_XDP (XDP sockets with XSKMAP) is in use, for example with `bpftool map show` listing xskmap entries.","fix":"- Update the Linux kernel to a build that includes the upstream fix 'xsk: Use a 32-bit compare in xsk_map_gen_lookup'; the exact fixed version is unknown from the sources.\n- Reboot into the patched kernel.","status":"open","published_at":"2026-10-18T16:17:16+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:21:05+00:00","updated_at":"2026-10-25T05:21:05+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:21:05Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a build that includes the upstream fix 'xsk: Use a 32-bit compare in xsk_map_gen_lookup'; the exact fixed version is unknown from the sources.\n- Reboot into the patched kernel.","reach":"local","title":"Linux kernel: AF_XDP map lookup skips bounds check, reads past array","impact":"medium","summary":"The Linux kernel's AF_XDP socket map lookup code compares a 32-bit index against the map size using a sign-extended 64-bit immediate, so a map with 0x80000000 or more entries lets an out-of-range index skip the bounds check. The generated lookup then reads memory past the end of the xsk_map array.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","af-xdp","bpf","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"out-of-bounds memory read in kernel, possible information leak or crash","analyst_note":"Find the affected kernel version range and distribution fix versions from the NVD entry and the upstream stable commit; the sources give no CVSS or fixed version.","how_to_check":"- Run `uname -r` and compare against the fixed kernel builds listed by the distribution or the upstream commit.\n- Check whether AF_XDP (XDP sockets with XSKMAP) is in use, for example with `bpftool map show` listing xskmap entries.","needs_analyst":true,"not_affected_if":["no-af-xdp","no-xskmap"],"who_is_affected":"Only systems that load BPF programs that use XSKMAP lookups with very large map sizes are reachable by this path, which in practice means hosts running AF_XDP workloads. The sources do not say which kernel versions are affected or which distributions have shipped fixes, so ordinary hosts that do not use AF_XDP sockets can likely skip urgent action.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000692,"input_tokens":3445,"output_tokens":695,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98631':15A,18A '0x80000000':60B,143C '32':41B,102C,155C,187C '64':53B,135C 'af':3A,20B,33B 'af-xdp':19B 'array':12A,88B 'becom':146C 'bit':42B,54B,103C,136C,156C,188C 'bound':8A,73B,167C 'bpf':22B,125C,128C,179C 'check':9A,74B,168C,184C 'code':38B 'compar':39B,104C,119C,177C 'cve':13A,16A 'end':83B 'entri':63B,123C,140C 'everi':151C 'extend':52B,133C,154C 'follow':94C 'gen':108C,112C 'generat':76B,171C 'higher':145C 'host':28B 'imm':127C,181C 'immedi':55B,129C 'index':43B,70B,163C 'infrastructur':23B 'jmp':126C 'jmp32':180C 'kernel':2A,24B,31B,92C 'key':117C,157C 'larger':149C 'let':64B 'linux':1A,25B,30B,91C 'load':114C 'lookup':6A,37B,77B,109C,113C,172C 'map':5A,36B,46B,58B,87B,107C,111C,176C 'max':122C,139C 'memori':80B 'out-of-rang':66B,159C 'past':11A,81B,174C 'rang':69B,162C,190C 'read':10A,79B,173C 'resolv':98C 'self':27B 'self-host':26B 'sign':51B,132C 'sign-extend':50B,131C 'size':47B 'skip':7A,71B,165C 'socket':35B 'stay':185C 'threshold':148C 'u32':116C 'unsign':189C 'use':48B,100C,124C 'valu':141C 'vulner':95C 'xdp':4A,21B,34B 'xsk':86B,99C,106C,110C,175C 'zero':153C 'zero-extend':152C","nicknames":[],"mitigations":[],"who_affected":"Only systems that load BPF programs that use XSKMAP lookups with very large map sizes are reachable by this path, which in practice means hosts running AF_XDP workloads. The sources do not say which kernel versions are affected or which distributions have shipped fixes, so ordinary hosts that do not use AF_XDP sockets can likely skip urgent action.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98631","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98631","severity":null,"published_at":"2026-10-18T16:17:16+00:00","modified_at":"2026-10-19T10:19:27+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}