CVE-2026-98041: bpf: Don't predict JMP32 pointer vs zero comparisons
In the Linux kernel, the following vulnerability has been resolved:
bpf: Don't predict JMP32 pointer vs zero comparisons
Consider the following program:
r1 = mapvalue; / low 32 bits are zero at runtime / r6 = 0xdead000000000000; if w1 != 0 goto l1; l0: r1 += r6; r2 = (u64 )(r1 + 0); exit; l1: r6 = 0; goto l0;
At the moment isbranchtaken() reports the jump as always taken, because it does not distinguish between BPFJMP and BPFJMP32 comparisons when processing 'if w1 != 0 ...'.
Affected Software
Event History
Frequently Asked Questions
What condition is required to trigger the verifier error?
The BPF program must use a JMP32 comparison between a pointer-derived value and zero, where the low 32 bits can be zero at runtime. The verifier incorrectly treats the branch as always taken because it does not distinguish JMP32 from full-width BPF_JMP comparisons.
What is the practical consequence of the incorrect branch prediction?
It can cause the verifier to reason about an unreachable branch incorrectly. In the provided example, this allows control-flow reasoning to miss the path where a pointer-derived register is combined with a nonzero 64-bit value before a memory load.
How can I determine whether a BPF program may be affected?
Review BPF programs accepted by the kernel for 32-bit conditional jumps, such as comparisons using w-register operands, involving pointer-derived values and zero. Programs using only full-width comparisons or without this control-flow pattern are not described by the supplied data as affected.