CVE-2026-98572 bpf: Fix immediate JMP JEQ/JNE on MIPS32
A bug in the Linux kernel's BPF JIT compiler for MIPS32 causes invalid comparisons, potentially leading to denial of service or incorrect program behavior.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98572?
CVE-2026-98572 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix immediate JMP JEQ/JNE on MIPS32
An addu instruction was emitted instead of addiu, causing the immediate value 1 to be interpreted as register $at. This made the comparison result invalid when the immediate operand was negative. Note that $at is mapped to BPF_REG_AX, which is used for constant blinding.
Fix the instruction to use the immediate form.
Found with test_bpf on MIPS32r1 emulated by QEMU.
Which versions are affected by CVE-2026-98572?
How do I fix CVE-2026-98572?
Apply the vendor's patch.
Is CVE-2026-98572 being exploited?
There is no known exploitation of CVE-2026-98572 in the wild and no public exploit code.
Sources
Also known as AZL-109202, BELL-CVE-2026-98572, DEBIAN-CVE-2026-98572, GHSA-jqhp-gcf3-75rx, UBUNTU-CVE-2026-98572.