CVE-2026-98041: Linux

High severity, CVSS 7.0. EPSS: 0.1% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: bpf: Don't predict JMP32 pointer vs zero comparisons Consider the following program: r1 = map_value; /* low 32 bits are zero at runtime */ r6 = 0xdead000000000000; if w1 != 0 goto l1; l0: r1 += r6; r2 = *(u64 *)(r1 + 0); exit; l1: r6 = 0; goto l0; At the moment is_branch_taken() reports the jump as always taken, because it does not distinguish between BPF_JMP and BPF_JMP32 comparisons when processing 'if w1 != 0 ...'.

Affected products

• Linux Linux: from 5.8, before 6.12.111 (fixed in 6.12.111); from 6.13, before 6.18.53 (fixed in 6.18.53); from 6.19, before 7.2.7 (fixed in 7.2.7)

Published 2026-09-25. Last modified 2026-09-25.