{"id":"CVE-2026-98856","kind":"vulnerability","aliases":["CVE-2026-98856"],"related":[],"title":"Linux kernel: kprobes overlap check can corrupt optimized jump and misroute execution","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nkprobes: Skip disarmed probes when checking optkprobe overlap\n\nOn x86, an optkprobe at A replaces five bytes with a jump. If a disabled\nprobe B is at A+2, get_optimized_kprobe() stops at B when arming a new\nprobe C at A+4. It leaves A optimized:\n\n              A    A+1  A+2  A+3  A+4\n  A's jump  | e9 | d0 | d1 | d2 | d3 |\n  after C   | e9 | d0 | d1 | d2 | cc |\n\nThe INT3 for C overwrites the last byte of A's jump displacement, so\nexecution can jump to the wrong address. B can have prepared optinsns\nwhile disarmed, but has no jump to unoptimize.\n\nContinue past disarmed and unprepared probes to find the active optimized\nprobe before arming a probe in its jump.","summary":"In the Linux kernel's kprobes code on x86, arming a new probe can overwrite part of an existing optimized probe's jump, so execution can jump to the wrong address. The sources do not state a confirmed attacker outcome beyond wrong-address execution.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kprobes","linux-kernel","x86"],"not_affected_if":["non-x86"],"how_to_check":"- `uname -r` and compare against a kernel build that includes the upstream fix for CVE-2026-98856\n- Check whether kprobes or optimized kprobes are in use (unknown from the sources)","fix":"- Update the Linux kernel to a release that includes the upstream kprobes fix for CVE-2026-98856 (exact versions unknown from the sources)","status":"open","published_at":"2026-10-18T16:17:40+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:12:57+00:00","updated_at":"2026-10-25T05:12:57+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:12:57Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream kprobes fix for CVE-2026-98856 (exact versions unknown from the sources)","reach":"local","title":"Linux kernel: kprobes overlap check can corrupt optimized jump and misroute execution","impact":"medium","summary":"In the Linux kernel's kprobes code on x86, arming a new probe can overwrite part of an existing optimized probe's jump, so execution can jump to the wrong address. The sources do not state a confirmed attacker outcome beyond wrong-address execution.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","x86","kprobes"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown: kernel execution may jump to a wrong address","analyst_note":"Confirm affected kernel versions, fixed commit and whether an attacker can trigger probe arming, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-98856.","how_to_check":"- `uname -r` and compare against a kernel build that includes the upstream fix for CVE-2026-98856\n- Check whether kprobes or optimized kprobes are in use (unknown from the sources)","needs_analyst":true,"not_affected_if":["non-x86"],"who_is_affected":"Systems running a Linux kernel on x86 that use kprobes with optimized probes. Systems without kprobe use or on non-x86 architectures are likely not affected, but the sources do not confirm this.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000637,"input_tokens":3515,"output_tokens":570,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+1':130C '+2':108C,132C '+3':134C '+4':123C,136C '-2026':14A,17A '-98856':15A,18A 'activ':195C 'address':55B,68B,172C 'arm':34B,116C,199C 'attack':63B 'b':104C,114C,173C 'beyond':65B 'byte':96C,159C 'c':120C,146C,155C 'cc':151C 'check':5A,85C 'code':31B 'confirm':62B 'continu':186C 'corrupt':7A 'cve':13A,16A 'd0':141C,148C 'd1':142C,149C 'd2':143C,150C 'd3':144C 'disabl':102C 'disarm':82C,179C,188C 'displac':164C 'e9':140C,147C 'execut':12A,49B,69B,166C 'exist':43B 'find':193C 'five':95C 'follow':75C 'get':109C 'infrastructur':19B 'int3':153C 'jump':9A,47B,51B,99C,139C,163C,168C,183C,204C 'kernel':2A,23B,28B,73C 'kprobe':3A,20B,30B,80C,111C 'last':158C 'leav':125C 'linux':1A,22B,27B,72C 'linux-kernel':21B 'misrout':11A 'new':36B,118C 'optim':8A,44B,110C,127C,196C 'optinsn':177C 'optkprob':86C,91C 'outcom':64B 'overlap':4A,87C 'overwrit':39B,156C 'part':40B 'past':187C 'prepar':176C 'probe':37B,45B,83C,103C,119C,191C,197C,201C 'replac':94C 'resolv':79C 'skip':81C 'sourc':57B 'state':60B 'stop':112C 'unoptim':185C 'unprepar':190C 'vulner':76C 'wrong':54B,67B,171C 'wrong-address':66B 'x86':24B,33B,89C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel on x86 that use kprobes with optimized probes. Systems without kprobe use or on non-x86 architectures are likely not affected, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:40+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98856","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98856","severity":null,"published_at":"2026-10-18T16:17:40+00:00","modified_at":"2026-10-21T13:21:50+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}