{"id":"CVE-2026-98041","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Don't predict JMP32 pointer vs zero comparisons\n\nConsider the following program:\n\n        r1 = map_value;      /* low 32 bits are zero at runtime */\n        r6 = 0…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Don't predict JMP32 pointer vs zero comparisons\n\nConsider the following program:\n\n        r1 = map_value;      /* low 32 bits are zero at runtime */\n        r6 = 0…","severity":"high","cvss":7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= cac616db39c207dc63465a4e05c6ce0e60b2cce4 < d16f0eafcaa62e677a2b5b0dabc1f8d31dfe3d4d","Linux >= cac616db39c207dc63465a4e05c6ce0e60b2cce4 < e2ae33247e8b2dbe9d116d3e61cadf6d548339c6","Linux >= cac616db39c207dc63465a4e05c6ce0e60b2cce4 < a4d7f94c1ca914469ced665ec2f98be669aef462","Linux >= cac616db39c207dc63465a4e05c6ce0e60b2cce4 < e51179a4e09846f8fd0f26a05068520de2b301bf","Linux 5.8"],"published":"2026-09-25","updated":"2026-09-25","sourceUpdated":"2026-09-25T15:18:04.747","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98041","references":[{"url":"https://git.kernel.org/stable/c/a4d7f94c1ca914469ced665ec2f98be669aef462","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d16f0eafcaa62e677a2b5b0dabc1f8d31dfe3d4d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e2ae33247e8b2dbe9d116d3e61cadf6d548339c6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e51179a4e09846f8fd0f26a05068520de2b301bf","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-25T11:06:38.849Z","slug":"CVE-2026-98041","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Don't predict JMP32 pointer vs zero comparisons\n\nConsider the following program:\n\n        r1 = map_value;      /* low 32 bits are zero at runtime */\n        r6 = 0xdead000000000000;\n        if w1 != 0 goto l1;\n    l0: r1 += r6;\n        r2 = *(u64 *)(r1 + 0);\n        exit;\n    l1: r6 = 0;\n        goto l0;\n\nAt the moment is_branch_taken() reports the jump as always taken,\nbecause it does not distinguish between BPF_JMP and BPF_JMP32\ncomparisons when processing 'if w1 != 0 ...'.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":38.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":210932,"id":"CVE-2026-98041","ts":1790349116761,"field":"cvss","old":null,"new":"7"},{"seq":210931,"id":"CVE-2026-98041","ts":1790349116761,"field":"severity","old":"none","new":"high"}]}