{"id":"CVE-2026-98816","published":"2026-10-18T16:17:35.770","lastModified":"2026-10-19T10:19:45.683","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix overflow of jump offset in constant blinding\n\nbpf_jit_blind_insn() rewrites 'if rX op imm goto off' into:\n\n  AX = imm ^ rnd\n  AX ^= rnd\n  if rX op AX goto off\n\nand subtracts 2 from off when the jump is backward. off is s16, so\n-32767 and -32768 wrap and the jump goes 32767 insns forward, past the\nend of the prog. The jump is inside the patch, hence bpf_adj_branches()\ndoesn't check it. The kernel crashes when such prog runs with\nbpf_jit_harden=2.\n\nReturn -ERANGE in such case. bpf_jit_blind_constants() fails the same\nway when blinding of other insns moves a jump out of range.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/443328237113ee0ea515e506497334d871dbc2aa","tags":[]},{"url":"https://git.kernel.org/stable/c/ad139384ecddb6f3e7e3c3c12765aafae0e39670","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}