CVE-2026-98816

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix overflow of jump offset in constant blinding

bpf_jit_blind_insn() rewrites 'if rX op imm goto off' into:

AX = imm ^ rnd

AX ^= rnd

if rX op AX goto off

and subtracts 2 from off when the jump is backward. off is s16, so

-32767 and -32768 wrap and the jump goes 32767 insns forward, past the

end of the prog. The jump is inside the patch, hence bpf_adj_branches()

doesn't check it. The kernel crashes when such prog runs with

bpf_jit_harden=2.

Return -ERANGE in such case. bpf_jit_blind_constants() fails the same

way when blinding of other insns moves a jump out of range.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References