CVE-2026-98572: bpf: Fix immediate JMP JEQ/JNE on MIPS32
bpf: Fix immediate JMP JEQ/JNE on MIPS32
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.159.1-1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are affected by this issue?
The issue affects the Linux kernel BPF JIT behavior on MIPS32. The faulty code path was identified on MIPS32r1 under QEMU emulation.
Under what condition does the comparison produce an invalid result?
An immediate JEQ or JNE comparison can produce an invalid result when its immediate operand is negative. The generated code used a register-based addu instruction instead of the immediate-form addiu instruction.
How does constant blinding relate to the impact?
The incorrectly referenced $at register is mapped to BPF_REG_AX, which is used for constant blinding. As a result, the comparison may use the value held in that register rather than the intended immediate value.
How can this issue be detected?
The defect was found using test_bpf on MIPS32r1 emulated by QEMU. Testing immediate BPF JEQ and JNE operations with negative immediate operands can exercise the affected behavior.