CVE-2026-98631 xsk: Use a 32-bit compare in xsk_map_gen_lookup
A sign-extension flaw in Linux kernel XSK map lookup allows out-of-bounds memory reads, potentially causing information disclosure or crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98631?
CVE-2026-98631 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
xsk: Use a 32-bit compare in xsk_map_gen_lookup
xsk_map_gen_lookup() loads a u32 key and compares it with max_entries using BPF_JMP_IMM. BPF immediates are sign-extended to 64 bits, so a max_entries value of 0x80000000 or higher becomes a threshold larger than every zero-extended 32-bit key. An out-of-range index then skips the bounds check and the generated lookup reads past xsk_map[].
Compare with BPF_JMP32_IMM so the check stays in 32-bit unsigned range.
Which versions are affected by CVE-2026-98631?
How do I fix CVE-2026-98631?
Apply the vendor's patch.
Is CVE-2026-98631 being exploited?
There is no known exploitation of CVE-2026-98631 in the wild and no public exploit code.
Sources
Also known as AZL-108740, BELL-CVE-2026-98631, DEBIAN-CVE-2026-98631, GHSA-r8m8-f9qq-5h53, UBUNTU-CVE-2026-98631.