CVE-2026-98590 (GCVE-0-2026-98590)
Vulnerability from cvelistv5
Published
2026-10-18 15:19
Modified
2026-10-19 09:22
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpf_sock context code generation Currently, the ctx access code reads the rx_queue_mapping field with either a 4-byte or 2-byte load. The rest of the bits in the register are marked known zero by the verifier. However, the emitted ctx access code places in the register on certain the special value (-1) using BPF_MOV_IMM64, which gets sign-extended to turn on all the bits in the register. By shifting this value right, the program ends up with a value at runtime above what the verifier assumes is possible. Fix this by ensuring the read value is as wide as the assumed size. Use MOV32 instructions instead of MOV64 instructions to keep the upper bits zero as assumed by the verifier. Also properly report the size of the destination variable (the bpf_sock field, 4 bytes) instead of the source (the socket field, 2 bytes).
References
Impacted products
Vendor Product Version
Linux Linux Version: c3c16f2ea6d20159903cf93afbb1155f3d8348d5
Version: c3c16f2ea6d20159903cf93afbb1155f3d8348d5
Version: c3c16f2ea6d20159903cf93afbb1155f3d8348d5
Version: c3c16f2ea6d20159903cf93afbb1155f3d8348d5
Version: c3c16f2ea6d20159903cf93afbb1155f3d8348d5
Version: c3c16f2ea6d20159903cf93afbb1155f3d8348d5
Version: c3c16f2ea6d20159903cf93afbb1155f3d8348d5
Version: c3c16f2ea6d20159903cf93afbb1155f3d8348d5
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e3ddcf4aeb342d4de2e5761c7042270d454752de",
              "status": "affected",
              "version": "c3c16f2ea6d20159903cf93afbb1155f3d8348d5",
              "versionType": "git"
            },
            {
              "lessThan": "4a41d064facc3330e176ecbbf5b0026ed18a5c69",
              "status": "affected",
              "version": "c3c16f2ea6d20159903cf93afbb1155f3d8348d5",
              "versionType": "git"
            },
            {
              "lessThan": "70288599d1754e157df8326239316dbdf08ea33c",
              "status": "affected",
              "version": "c3c16f2ea6d20159903cf93afbb1155f3d8348d5",
              "versionType": "git"
            },
            {
              "lessThan": "ea4dc96c902ccfa49dd3e4f23c443dab4a74b018",
              "status": "affected",
              "version": "c3c16f2ea6d20159903cf93afbb1155f3d8348d5",
              "versionType": "git"
            },
            {
              "lessThan": "b3f37afc7fd7c52bc2114310aff1eb24c7cd4d73",
              "status": "affected",
              "version": "c3c16f2ea6d20159903cf93afbb1155f3d8348d5",
              "versionType": "git"
            },
            {
              "lessThan": "d95dd5a6c6cd08d5ae466d3aed27b3cf59155a6c",
              "status": "affected",
              "version": "c3c16f2ea6d20159903cf93afbb1155f3d8348d5",
              "versionType": "git"
            },
            {
              "lessThan": "84ebb991ae985149079ae9ab51b7e3ba25a9ff53",
              "status": "affected",
              "version": "c3c16f2ea6d20159903cf93afbb1155f3d8348d5",
              "versionType": "git"
            },
            {
              "lessThan": "4a4852376e3a2727ea40e61143d6d7c22bb6dfad",
              "status": "affected",
              "version": "c3c16f2ea6d20159903cf93afbb1155f3d8348d5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.271",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.55",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.9",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix bpf_sock context code generation\n\nCurrently, the ctx access code reads the rx_queue_mapping\nfield with either a 4-byte or 2-byte load. The rest of the bits\nin the register are marked known zero by the verifier. However,\nthe emitted ctx access code places in the register on certain\nthe special value (-1) using BPF_MOV_IMM64, which gets sign-extended\nto turn on all the bits in the register. By shifting this value right,\nthe program ends up with a value at runtime above what the verifier\nassumes is possible.\n\nFix this by ensuring the read value is as wide as the assumed size.\nUse MOV32 instructions instead of MOV64 instructions to keep\nthe upper bits zero as assumed by the verifier. Also properly report\nthe size of the destination variable (the bpf_sock field, 4 bytes) instead\nof the source (the socket field, 2 bytes)."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:22:15.786Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e3ddcf4aeb342d4de2e5761c7042270d454752de"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a41d064facc3330e176ecbbf5b0026ed18a5c69"
        },
        {
          "url": "https://git.kernel.org/stable/c/70288599d1754e157df8326239316dbdf08ea33c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea4dc96c902ccfa49dd3e4f23c443dab4a74b018"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3f37afc7fd7c52bc2114310aff1eb24c7cd4d73"
        },
        {
          "url": "https://git.kernel.org/stable/c/d95dd5a6c6cd08d5ae466d3aed27b3cf59155a6c"
        },
        {
          "url": "https://git.kernel.org/stable/c/84ebb991ae985149079ae9ab51b7e3ba25a9ff53"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a4852376e3a2727ea40e61143d6d7c22bb6dfad"
        }
      ],
      "title": "bpf: Fix bpf_sock context code generation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98590",
    "datePublished": "2026-10-18T15:19:02.747Z",
    "dateReserved": "2026-09-25T10:25:14.358Z",
    "dateUpdated": "2026-10-19T09:22:15.786Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.