CVE-2026-98816 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix overflow of jump offset in constant blinding
bpf_jit_blind_insn() rewrites 'if rX op imm goto off' into:
AX = imm ^ rnd AX ^= rnd if rX op AX goto off
and subtracts 2 from off when the jump is backward. off is s16, so -32767 and -32768 wrap and the jump goes 32767 insns forward, past the end of the prog. The jump is inside the patch, hence bpf_adj_branches() doesn't check it. The kernel crashes when such prog runs with bpf_jit_harden=2.
Return -ERANGE in such case. bpf_jit_blind_constants() fails the same way when blinding of other insns moves a jump out of range.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The Linux kernel contains a critical vulnerability within its Berkeley Packet Filter (BPF) subsystem, specifically affecting the constant blinding mechanism used to harden BPF programs against side-channel attacks. This flaw arises from an integer overflow in the handling of jump offsets during the JIT compilation process when bpf_jit_harden is enabled with level 2 or higher. The vulnerability impacts system stability and can lead to kernel crashes, representing a significant risk for environments relying on BPF-based security policies such as eBPF programs used in network filtering, observability tools, and container isolation mechanisms.
The technical root cause lies in the bpf_jit_blind_insn function, which is responsible for rewriting conditional branch instructions to obfuscate immediate values using randomization constants. Specifically, when processing an instruction of the form if rX op imm goto off, the compiler transforms it into a sequence involving AX = imm ^ rnd followed by AX ^= rnd and then the conditional jump. During this transformation, particularly for backward jumps, the code subtracts 2 from the offset value to adjust for the inserted instructions. However, because the offset is stored as a signed sixteen-bit integer (s16), it has a limited range of -32768 to +32767. When the original jump offset is near the lower boundary, such as -32767 or -32768, subtracting 2 causes an underflow that wraps around to positive values like 32767. This results in a forward jump of over thirty thousand instructions instead of the intended backward jump, effectively directing execution past the end of the program buffer.
This out-of-bounds access is particularly dangerous because it occurs within the patching phase of JIT compilation. The function bpf_adj_branches(), which typically validates and adjusts branch targets to ensure they remain within valid bounds, does not check this specific case during the blinding process. Consequently, when a BPF program with such an invalid offset is executed under hardened conditions, the kernel attempts to jump to memory locations outside the allocated program space. This leads to an immediate crash or panic in the kernel due to illegal instruction fetching or memory access violations, disrupting services that depend on these BPF programs and potentially causing denial of service for the host system.
From a classification perspective, this vulnerability aligns with CWE-190 Integer Overflow or Wraparound, as the arithmetic operation exceeds the representable range of the data type without proper bounds checking. It also relates to CWE-787 Out-of-bounds Write if the execution flow leads to memory corruption, though in this specific instance, it primarily manifests as a crash due to invalid control flow transfer. In terms of MITRE ATT&CK mapping, while not directly exploitable for remote code execution by an attacker without prior access, it represents a weakness that could be leveraged in conjunction with other vulnerabilities or through crafted BPF programs submitted by unprivileged users who have permission to load eBPF programs, potentially leading to local privilege escalation if the crash conditions can be manipulated further.
The resolution involves modifying the bpf_jit_blind_constants function and related logic to detect when a jump offset would wrap around due to arithmetic underflow or overflow during blinding operations. Instead of proceeding with an invalid transformation that results in out-of-bounds jumps, the kernel now returns -ERANGE, indicating that the range is exceeded and the operation cannot be safely performed. This prevents the generation of malformed JIT code and ensures that BPF programs requiring such transformations are rejected before they can cause a system crash. Additionally, similar checks have been applied to other instruction blinding scenarios where moving jumps could result in out-of-range targets, ensuring comprehensive coverage against this class of arithmetic errors.
To mitigate the impact of this vulnerability, administrators should ensure their Linux kernels are updated with patches that include fixes for bpf_jit_blind_insn and related functions. For systems running older kernel versions where immediate patching is not possible, restricting unprivileged users from loading BPF programs can reduce exposure. Furthermore, monitoring system logs for oops or panic messages associated with eBPF execution may help identify affected instances in production environments. Regularly auditing the use of bpf_jit_harden settings and ensuring that only trusted, validated BPF programs are deployed is recommended to maintain robust security posture against such low-level arithmetic flaws.