{"id":"CVE-2026-98816","kind":"vulnerability","aliases":["CVE-2026-98816"],"related":[],"title":"Linux kernel BPF: constant blinding jump overflow crashes kernel with hardening","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix overflow of jump offset in constant blinding\n\nbpf_jit_blind_insn() rewrites 'if rX op imm goto off' into:\n\n  AX = imm ^ rnd\n  AX ^= rnd\n  if rX op AX goto off\n\nand subtracts 2 from off when the jump is backward. off is s16, so\n-32767 and -32768 wrap and the jump goes 32767 insns forward, past the\nend of the prog. The jump is inside the patch, hence bpf_adj_branches()\ndoesn't check it. The kernel crashes when such prog runs with\nbpf_jit_harden=2.\n\nReturn -ERANGE in such case. bpf_jit_blind_constants() fails the same\nway when blinding of other insns moves a jump out of range.","summary":"The Linux kernel's BPF JIT constant blinding rewrites a backward conditional jump and can overflow its signed 16-bit offset, so the jump lands past the end of the program. With bpf_jit_harden=2 the kernel crashes when such a program runs.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ebpf","kernel","linux","runtime","self-hosted"],"not_affected_if":["bpf-disabled","bpf_jit_harden-default"],"how_to_check":"- Run `sysctl net.core.bpf_jit_harden` and check whether it is `2`\n- Run `uname -r` and compare against the fixed kernel version listed by the distribution advisory (unknown from these sources)","fix":"- Update the Linux kernel to a release that includes the upstream commit fixing bpf_jit_blind_insn() (version unknown from these sources)\n- Keep `net.core.bpf_jit_harden` at `0` or `1` until patched","status":"open","published_at":"2026-10-18T16:17:35+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:14:48+00:00","updated_at":"2026-10-25T05:14:48+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:14:48Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit fixing bpf_jit_blind_insn() (version unknown from these sources)\n- Keep `net.core.bpf_jit_harden` at `0` or `1` until patched","reach":"local","title":"Linux kernel BPF: constant blinding jump overflow crashes kernel with hardening","impact":"low","summary":"The Linux kernel's BPF JIT constant blinding rewrites a backward conditional jump and can overflow its signed 16-bit offset, so the jump lands past the end of the program. With bpf_jit_harden=2 the kernel crashes when such a program runs.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","ebpf","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"kernel crashes when a crafted BPF program runs","analyst_note":"Confirm the fixed kernel version and stable backport commit from the NVD entry and kernel.org stable mailing list.","how_to_check":"- Run `sysctl net.core.bpf_jit_harden` and check whether it is `2`\n- Run `uname -r` and compare against the fixed kernel version listed by the distribution advisory (unknown from these sources)","needs_analyst":true,"not_affected_if":["bpf_jit_harden-default","bpf-disabled"],"who_is_affected":"Only systems running a Linux kernel with the BPF JIT enabled and bpf_jit_harden set to 2 are exposed, and the crash needs a BPF program with such a jump to run, which typically means a user or process that can load eBPF programs. Hosts with unprivileged BPF disabled and hardening at default can likely skip it, though the sources do not state this. Multi-tenant hosts and container nodes that allow BPF loading are the systems to look at first.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000686,"input_tokens":3491,"output_tokens":673,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-32767':125C '-32768':127C '-98816':14A,17A '16':43B '2':60B,113C,167C '32767':133C 'adj':150C 'ax':100C,103C,108C 'backward':35B,120C 'bit':44B 'blind':5A,32B,87C,90C,175C,182C 'bpf':3A,29B,57B,79C,88C,149C,164C,173C 'branch':151C 'case':172C 'check':154C 'condit':36B 'constant':4A,31B,86C,176C 'crash':8A,63B,158C 'cve':12A,15A 'doesn':152C 'ebpf':18B 'end':52B,138C 'erang':169C 'fail':177C 'fix':80C 'follow':74C 'forward':135C 'goe':132C 'goto':97C,109C 'harden':11A,59B,166C 'henc':148C 'host':24B 'imm':96C,101C 'insid':145C 'insn':91C,134C,185C 'jit':30B,58B,89C,165C,174C 'jump':6A,37B,48B,83C,118C,131C,143C,188C 'kernel':2A,9A,19B,27B,62B,72C,157C 'land':49B 'linux':1A,20B,26B,71C 'move':186C 'offset':45B,84C 'op':95C,107C 'overflow':7A,40B,81C 'past':50B,136C 'patch':147C 'prog':141C,161C 'program':55B,67B 'rang':191C 'resolv':78C 'return':168C 'rewrit':33B,92C 'rnd':102C,104C 'run':68B,162C 'runtim':21B 'rx':94C,106C 's16':123C 'self':23B 'self-host':22B 'sign':42B 'subtract':112C 'vulner':75C 'way':180C 'wrap':128C","nicknames":[],"mitigations":[],"who_affected":"Only systems running a Linux kernel with the BPF JIT enabled and bpf_jit_harden set to 2 are exposed, and the crash needs a BPF program with such a jump to run, which typically means a user or process that can load eBPF programs. Hosts with unprivileged BPF disabled and hardening at default can likely skip it, though the sources do not state this. Multi-tenant hosts and container nodes that allow BPF loading are the systems to look at first.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98816","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98816","severity":null,"published_at":"2026-10-18T16:17:35+00:00","modified_at":"2026-10-19T10:19:45+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}