Live › vulnerability › CVE-2026-98816
Go to dashboardThe Linux kernel's BPF JIT constant blinding rewrites a backward conditional jump and can overflow its signed 16-bit offset, so the jump lands past the end of the program. With bpf_jit_harden=2 the kernel crashes when such a program runs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems running a Linux kernel with the BPF JIT enabled and bpf_jit_harden set to 2 are exposed, and the crash needs a BPF program with such a jump to run, which typically means a user or process that can load eBPF programs. Hosts with unprivileged BPF disabled and hardening at default can likely skip it, though the sources do not state this. Multi-tenant hosts and container nodes that allow BPF loading are the systems to look at first.
No product ranges from the sources yet.
sysctl net.core.bpf_jit_harden and check whether it is 2uname -r and compare against the fixed kernel version listed by the distribution advisory (unknown from these sources)net.core.bpf_jit_harden at 0 or 1 until patchedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix overflow of jump offset in constant blinding
bpf_jit_blind_insn() rewrites 'if rX op imm goto off' into:
AX = imm ^ rnd AX ^= rnd if rX op AX goto off
and subtracts 2 from off when the jump is backward. off is s16, so -32767 and -32768 wrap and the jump goes 32767 insns forward, past the end of the prog. The jump is inside the patch, hence bpf_adj_branches() doesn't check it. The kernel crashes when such prog runs with bpf_jit_harden=2.
Return -ERANGE in such case. bpf_jit_blind_constants() fails the same way when blinding of other insns moves a jump out of range.
This page as .md · .json · in your agent: get_signal("CVE-2026-98816")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.