CVE-2026-98856

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

kprobes: Skip disarmed probes when checking optkprobe overlap

On x86, an optkprobe at A replaces five bytes with a jump. If a disabled

probe B is at A+2, get_optimized_kprobe() stops at B when arming a new

probe C at A+4. It leaves A optimized:

A A+1 A+2 A+3 A+4

A's jump | e9 | d0 | d1 | d2 | d3 |

after C | e9 | d0 | d1 | d2 | cc |

The INT3 for C overwrites the last byte of A's jump displacement, so

execution can jump to the wrong address. B can have prepared optinsns

while disarmed, but has no jump to unoptimize.

Continue past disarmed and unprepared probes to find the active optimized

probe before arming a probe in its jump.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References