{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-98888 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2026-98888 is a vulnerability in Linux, published on 23 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-98888 and fix it if it is affected.\n\nWhat it is: CVE-2026-98888 is a vulnerability in Linux, published on 23 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-98888 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-98888/ (Markdown: https://insights.sbomify.com/CVE-2026-98888/index.md)","id":"CVE-2026-98888","markdown":"https://insights.sbomify.com/CVE-2026-98888/index.md","name":"CVE-2026-98888","record":{"aliases":["AZL-110629","BELL-CVE-2026-98888","DEBIAN-CVE-2026-98888","GHSA-g4px-h95h-7mgm","UBUNTU-CVE-2026-98888"],"analysis":null,"analysis_generated_by":null,"assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64: kprobes: Allow reentering kprobes while single-stepping\n\nA kprobe can be hit while another kprobe is in KPROBE_HIT_SS state. This\ncan happen when tracing or perf code runs from the debug exception path\nwhile the first kprobe is preparing or executing its out-of-line\nsingle-step instruction.\n\nCurrently arm64 treats a kprobe hit in KPROBE_HIT_SS as unrecoverable,\nthe same as a hit in KPROBE_REENTER. This is too strict. A hit in\nKPROBE_HIT_SS is still a one-level reentry and can be handled by saving\nthe current kprobe state and setting up single-step for the new probe,\njust like reentry from KPROBE_HIT_ACTIVE or KPROBE_HIT_SSDONE.\n\nThe truly unrecoverable case is hitting another kprobe while already in\nKPROBE_REENTER, because the reentry save area has already been consumed.\n\nMove KPROBE_HIT_SS to the recoverable reentry cases and leave\nKPROBE_REENTER as the unrecoverable nested reentry case.\n\nThis change also requires saving saved_irqflag in struct prev_kprobe.\nWhen a nested kprobe calls kprobes_save_local_irqflag(), it overwrites\nkcb-\u003esaved_irqflag with the currently masked DAIF value, losing the\nouter kprobe's original DAIF state. Without this fix, when the outer\nkprobe's single-step finishes, kprobes_restore_local_irqflag() applies\nthe wrong DAIF mask and leaves interrupts permanently disabled.\n\nExtend struct prev_kprobe with a saved_irqflag field and save/restore it\nalongside kp and status. This ensures the outer kprobe's original\ninterrupt state is preserved across reentry.\n\nThis mirrors the x86 fix in commit 6a5022a56ac3\n(\"kprobes/x86: Allow to handle reentered kprobe on single-stepping\").","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"arm64: kprobes: Allow reentering kprobes while single-stepping","id":"CVE-2026-98888","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":null,"year":"2026"},"n_packages":0,"n_references":7,"next":{"headline":"wifi: iwlwifi: mvm: fix sched scan IE sizing","id":"CVE-2026-98889"},"packages":[],"prev":{"headline":"wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO","id":"CVE-2026-98887"},"products":["Linux"],"published":"2026-10-23","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-26","vendors":["Linux"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-98888/"}