CVE-2026-98572 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix immediate JMP JEQ/JNE on MIPS32
An addu instruction was emitted instead of addiu, causing the immediate value 1 to be interpreted as register $at. This made the comparison result invalid when the immediate operand was negative. Note that $at is mapped to BPF_REG_AX, which is used for constant blinding.
Fix the instruction to use the immediate form.
Found with test_bpf on MIPS32r1 emulated by QEMU.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The Linux kernel's Berkeley Packet Filter (BPF) subsystem contains a critical code generation flaw specific to the MIPS32 architecture, where an incorrect assembly instruction is emitted for certain jump comparisons involving immediate values. Specifically, when generating machine code for JEQ or JNE instructions that operate on immediate operands, the compiler incorrectly emits an addu instruction instead of the required addiu instruction. This subtle but significant deviation in instruction selection leads to a fundamental misinterpretation of the operand data during execution. The primary technical distinction between these two MIPS32 arithmetic operations lies in how they handle overflow and sign extension; while both perform addition, addiu treats its immediate operand as an unsigned value that is zero-extended or sign-extended depending on context without raising exceptions for signed overflow, whereas addu performs a standard bitwise operation. In this specific vulnerability scenario, the incorrect use of addu causes the immediate value one to be misinterpreted by the processor logic as referencing the special-purpose register $at, also known as BPF_REG_AX. This register is heavily utilized within the BPF subsystem for constant blinding mechanisms designed to mitigate side-channel attacks and ensure safe execution of untrusted eBPF programs.
The operational impact of this flaw is severe because it compromises the integrity of conditional branching logic used by network filters and security policies implemented via eBPF. When an immediate operand is negative, or in contexts where the distinction between register reference and immediate value becomes ambiguous due to the instruction encoding error, the comparison result becomes invalid. This means that a program intended to drop malicious packets might instead allow them through, or conversely, legitimate traffic could be incorrectly blocked. Since BPF programs are often deployed at critical network ingress and egress points within cloud environments and container orchestration systems like Kubernetes, such logic errors can lead to significant security bypasses. Attackers who can influence the execution path of a vulnerable BPF program may exploit this incorrect branching behavior to evade detection rules or access restricted resources that should have been blocked by the filter's conditional checks.
From an industry standards perspective, this vulnerability aligns with CWE-682, which covers Incorrect Calculation, as well as CWE-479 regarding Statement Missing Return Value if it leads to undefined behavior in control flow, though more accurately it reflects a compiler or code generator error leading to incorrect instruction selection often categorized under implementation flaws. In the context of the MITRE ATT&CK framework, this flaw could facilitate techniques related to Defense Evasion by allowing malicious eBPF programs to bypass network security controls that rely on accurate conditional logic for packet filtering and monitoring. The vulnerability was identified using test_bpf during emulation via QEMU on MIPS32r1 hardware profiles, highlighting the importance of architecture-specific testing in kernel development cycles.
Mitigation strategies primarily involve applying the upstream Linux kernel patch that corrects the instruction emission to use addiu instead of addu for these specific immediate jump comparisons. System administrators managing infrastructure utilizing MIPS-based processors must ensure their kernels are updated to versions where this fix is included. For organizations unable to immediately update, monitoring network traffic patterns for anomalies in BPF-filtered segments may provide early warning signs of exploitation attempts, although the low-level nature of this flaw makes detection difficult without deep packet inspection capabilities that understand eBPF logic states. Long-term remediation requires rigorous architecture-specific unit testing and fuzzing campaigns targeting the JIT compiler components to prevent similar instruction selection errors across other MIPS variants or different architectures where immediate operand handling is critical for security policy enforcement.