Linux Kernel up to 7.1.5/7.2-rc4 LoongArch comparison

Summaryinfo

A vulnerability categorized as very critical has been discovered in Linux Kernel up to 7.1.5/7.2-rc4. This impacts an unknown function of the component LoongArch. Executing a manipulation can lead to comparison. This vulnerability is tracked as CVE-2026-68295. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.1.5/7.2-rc4. It has been declared as very critical. This vulnerability affects an unknown functionality of the component LoongArch. The manipulation with an unknown input leads to a comparison vulnerability. The CWE definition for the vulnerability is CWE-697. The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Zero-extend signed ALU32 div/mod results ALU32 operations write a 32-bit result and leave the upper 32 bits of the BPF register zero. The LoongArch JIT sign-extends the result of signed ALU32 BPF_DIV and BPF_MOD (off=1), so a negative 32-bit quotient or remainder leaves bits 63:32 set in JITted code while the verifier and interpreter model those bits as zero. Keep sign-extension on the operands, which signed divide needs, and zero-extend the ALU32 result after the divide or modulo instruction, matching the unsigned ALU32 div/mod paths and every other ALU32 operation in this JIT.

The advisory is available at git.kernel.org. This vulnerability was named CVE-2026-68295 since 07/30/2026. The exploitation appears to be easy. The attack can be initiated remotely. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $5k-$25k at the moment (estimation calculated on 08/10/2026).

Upgrading to version 7.1.6 or 7.2-rc5 eliminates this vulnerability. Applying the patch 716cb29dbed4d62e9e108950a1a82bcba4cc2d45/dacd348b8a993373576fe2ee2d8b114740ba57a6 is able to eliminate this problem.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.1.5
• 7.2-rc1
• 7.2-rc2
• 7.2-rc3
• 7.2-rc4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion