{"id":"CVE-2026-98816","title":"bpf: Fix overflow of jump offset in constant blinding","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix overflow of jump offset in constant blinding\n\nbpf_jit_blind_insn() rewrites 'if rX op imm goto off' into:\n\n  AX = imm ^ rnd\n  AX ^= rnd\n  if rX op AX goto off\n…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 4f3446bb809f20ad56cadf712e6006815ae7a8f9 < 443328237113ee0ea515e506497334d871dbc2aa","Linux >= 4f3446bb809f20ad56cadf712e6006815ae7a8f9 < ad139384ecddb6f3e7e3c3c12765aafae0e39670","Linux 4.7"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T15:49:05.616Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98816","references":[{"url":"https://git.kernel.org/stable/c/443328237113ee0ea515e506497334d871dbc2aa"},{"url":"https://git.kernel.org/stable/c/ad139384ecddb6f3e7e3c3c12765aafae0e39670"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T16:47:32.476Z","slug":"CVE-2026-98816","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix overflow of jump offset in constant blinding\n\nbpf_jit_blind_insn() rewrites 'if rX op imm goto off' into:\n\n  AX = imm ^ rnd\n  AX ^= rnd\n  if rX op AX goto off\n\nand subtracts 2 from off when the jump is backward. off is s16, so\n-32767 and -32768 wrap and the jump goes 32767 insns forward, past the\nend of the prog. The jump is inside the patch, hence bpf_adj_branches()\ndoesn't check it. The kernel crashes when such prog runs with\nbpf_jit_harden=2.\n\nReturn -ERANGE in such case. bpf_jit_blind_constants() fails the same\nway when blinding of other insns moves a jump out of range.\n\n## Affected\n\n- `Linux >= 4f3446bb809f20ad56cadf712e6006815ae7a8f9 < 443328237113ee0ea515e506497334d871dbc2aa`\n- `Linux >= 4f3446bb809f20ad56cadf712e6006815ae7a8f9 < ad139384ecddb6f3e7e3c3c12765aafae0e39670`\n- `Linux 4.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}