bpf: Don't predict JMP32 pointer vs zero comparisons (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.15 % · percentile 4 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Don't predict JMP32 pointer vs zero comparisons Consider the following program: r1 = map_value; /* low 32 bits are zero at runtime */ r6 = 0xdead000000000000; if w1 != 0 goto l1; l0: r1 += r6; r2 = *(u64 *)(r1 + 0); exit; l1: r6 = 0; goto l0; At the moment is_branch_taken() reports the jump as always taken, because it does not distinguish between BPF_JMP and BPF_JMP32 comparisons when processing 'if w1 != 0 ...'.
References
- https://git.kernel.org/stable/c/6e1544986536734166176c3add504add23bcbd15
- https://git.kernel.org/stable/c/d16f0eafcaa62e677a2b5b0dabc1f8d31dfe3d4d
- https://git.kernel.org/stable/c/e2ae33247e8b2dbe9d116d3e61cadf6d548339c6
- https://git.kernel.org/stable/c/a4d7f94c1ca914469ced665ec2f98be669aef462
- https://git.kernel.org/stable/c/e51179a4e09846f8fd0f26a05068520de2b301bf
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | Linux |
| CVSS 3.1 | HIGH 7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
European references
- ENISA EUVD · EUVD-2026-86694
- GCVE · GCVE-0-2026-98041
CERT-FR advisories
- CERTFR-2026-AVI-1432 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1289 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1253 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected cac616db39c207dc63465a4e05c6ce0e60b2cce4 < 6e1544986536734166176c3add504add23bcbd15 ; affected cac616db39c207dc63465a4e05c6ce0e60b2cce4 < d16f0eafcaa62e677a2b5b0dabc1f8d31dfe3d4d ; affected cac616db39c207dc63465a4e05c6ce0e60b2cce4 < e2ae33247e8b2dbe9d116d3e61cadf6d548339c6 ; affected cac616db39c207dc63465a4e05c6ce0e60b2cce4 < a4d7f94c1ca914469ced665ec2f98be669aef462 ; affected cac616db39c207dc63465a4e05c6ce0e60b2cce4 < e51179a4e09846f8fd0f26a05068520de2b301bf |
| Linux · Linux | affected 5.8 ; unaffected 0 < 5.8 ; unaffected 6.6.160 ≤ 6.6.* ; unaffected 6.12.111 ≤ 6.12.* ; unaffected 6.18.53 ≤ 6.18.* ; unaffected 7.2.7 ≤ 7.2.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |