CVE-2026-98631: xsk: Use a 32-bit compare in xsk_map_gen_lookup
In the Linux kernel, the following vulnerability has been resolved:
xsk: Use a 32-bit compare in xskmapgenlookup
xskmapgenlookup() loads a u32 key and compares it with maxentries using BPFJMPIMM. BPF immediates are sign-extended to 64 bits, so a maxentries value of 0x80000000 or higher becomes a threshold larger than every zero-extended 32-bit key. An out-of-range index then skips the bounds check and the generated lookup reads past xskmap[].
Compare with BPFJMP32IMM so the check stays in 32-bit unsigned range.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In Linux kernel xsk_map_gen_lookup(), compare the u32 key with max_entries using BPF_JMP32_IMM instead of BPF_JMP_IMM so the check remains in the 32-bit unsigned range.
Event History
Frequently Asked Questions
What condition is required for the bounds check to fail?
The XSK map must have a max_entries value of 0x80000000 or higher. At that size, the BPF_JMP_IMM comparison sign-extends the immediate value, causing an out-of-range zero-extended 32-bit key to bypass the generated bounds check.
What is the effect of successful exploitation?
An out-of-range index can skip the bounds check in xsk_map_gen_lookup() and cause the generated lookup to read past the xsk_map[] array.
How can this be mitigated in the code?
Use BPF_JMP32_IMM for the comparison so that the key and max_entries check remains in the 32-bit unsigned range.