GHSA-R8M8-F9QQ-5H53
Vulnerability from github – Published: 2026-10-18 18:31 – Updated: 2026-10-18 18:31In the Linux kernel, the following vulnerability has been resolved:
xsk: Use a 32-bit compare in xsk_map_gen_lookup
xsk_map_gen_lookup() loads a u32 key and compares it with max_entries using BPF_JMP_IMM. BPF immediates are sign-extended to 64 bits, so a max_entries value of 0x80000000 or higher becomes a threshold larger than every zero-extended 32-bit key. An out-of-range index then skips the bounds check and the generated lookup reads past xsk_map[].
Compare with BPF_JMP32_IMM so the check stays in 32-bit unsigned range.
{
"affected": [],
"aliases": [
"CVE-2026-98631"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-18T16:17:16Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: Use a 32-bit compare in xsk_map_gen_lookup\n\nxsk_map_gen_lookup() loads a u32 key and compares it with max_entries\nusing BPF_JMP_IMM. BPF immediates are sign-extended to 64 bits, so a\nmax_entries value of 0x80000000 or higher becomes a threshold larger\nthan every zero-extended 32-bit key. An out-of-range index then skips\nthe bounds check and the generated lookup reads past xsk_map[].\n\nCompare with BPF_JMP32_IMM so the check stays in 32-bit unsigned range.",
"id": "GHSA-r8m8-f9qq-5h53",
"modified": "2026-10-18T18:31:57Z",
"published": "2026-10-18T18:31:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98631"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/11d9be35c1f4233798e99be98bc474f83a254c6c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/123f90f394ca404ab8796a7c8072ff7fa5b65a9c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/227ec890559e922e235eb543646e3bf0bd8269b0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/36461e58f88a1b723f86693f437ac12e60ff4363"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3c1e0a4bc156b8d5c5772dbc76b9ea74dce5ca24"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/70504de0bb627848667207bec7ccfd647deb8814"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b5c0cff0c5331582ab01c4c423731453a8381acc"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c6d5c582d55a8f229d75e98d62eaa065b0deb18d"
}
],
"schema_version": "1.4.0",
"severity": []
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.