CVE-2026-98042

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98042", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:19:56.071Z", "datePublished": "2026-09-25T10:23:54.242Z", "dateUpdated": "2026-10-19T09:12:48.113Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:12:48.113Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Don't resurrect a scalar id dropped by collect_linked_regs()\n\ncheck_cond_jmp_op() copies the compared registers into\nenv->{false,true}_reg{1,2} before collect_linked_regs() runs and copies\nthose snapshots back into both branch states afterwards.\n\ncollect_linked_regs() records at most LINKED_REGS_MAX members of a\nlinked registers group in the jump history and calls clear_scalar_id()\nfor every member that does not fit. The compared register is not exempt\nfrom that.\n\nAs a consequence, sync_linked_regs() might adjust ranges for more\nregisters than bpf_bt_sync_linked_regs() can propagate precision to.\n\nCollect the linked registers before the snapshots are taken instead.\nThis might lead to some unnecessary clear_scalar_id's, but from\nprevious testing situations with many linked registers are\nextremely rare."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/verifier.c"], "versions": [{"version": "ec1d77cb0ee98249142dcd0376d76e7a48ba0b31", "lessThan": "e821ff19b8ef08255ff8d8234774ed814637e9bf", "status": "affected", "versionType": "git"}, {"version": "ec1d77cb0ee98249142dcd0376d76e7a48ba0b31", "lessThan": "73a98f96811e2cb0f4210b1caa8cb322f92f2a2b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/verifier.c"], "versions": [{"version": "7.1", "status": "affected"}, {"version": "0", "lessThan": "7.1", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e821ff19b8ef08255ff8d8234774ed814637e9bf"}, {"url": "https://git.kernel.org/stable/c/73a98f96811e2cb0f4210b1caa8cb322f92f2a2b"}], "title": "bpf: Don't resurrect a scalar id dropped by collect_linked_regs()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/bpf/verifier.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e821ff19b8ef08255ff8d8234774ed814637e9bf", "status": "affected", "version": "ec1d77cb0ee98249142dcd0376d76e7a48ba0b31", "versionType": "git"}, {"lessThan": "73a98f96811e2cb0f4210b1caa8cb322f92f2a2b", "status": "affected", "version": "ec1d77cb0ee98249142dcd0376d76e7a48ba0b31", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/bpf/verifier.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.1"}, {"lessThan": "7.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Don't resurrect a scalar id dropped by collect_linked_regs()\n\ncheck_cond_jmp_op() copies the compared registers into\nenv->{false,true}_reg{1,2} before collect_linked_regs() runs and copies\nthose snapshots back into both branch states afterwards.\n\ncollect_linked_regs() records at most LINKED_REGS_MAX members of a\nlinked registers group in the jump history and calls clear_scalar_id()\nfor every member that does not fit. The compared register is not exempt\nfrom that.\n\nAs a consequence, sync_linked_regs() might adjust ranges for more\nregisters than bpf_bt_sync_linked_regs() can propagate precision to.\n\nCollect the linked registers before the snapshots are taken instead.\nThis might lead to some unnecessary clear_scalar_id's, but from\nprevious testing situations with many linked registers are\nextremely rare."}], "id": "CVE-2026-98042", "lastModified": "2026-10-19T10:17:58.103", "metrics": {}, "published": "2026-09-25T11:17:32.987", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/73a98f96811e2cb0f4210b1caa8cb322f92f2a2b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e821ff19b8ef08255ff8d8234774ed814637e9bf"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: bpf: Don't resurrect a scalar id dropped by collect_linked_regs()", "id": "2541190", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541190"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: Don't resurrect a scalar id dropped by collect_linked_regs()\ncheck_cond_jmp_op() copies the compared registers into\nenv->{false,true}_reg{1,2} before collect_linked_regs() runs and copies\nthose snapshots back into both branch states afterwards.\ncollect_linked_regs() records at most LINKED_REGS_MAX members of a\nlinked registers group in the jump history and calls clear_scalar_id()\nfor every member that does not fit. The compared register is not exempt\nfrom that.\nAs a consequence, sync_linked_regs() might adjust ranges for more\nregisters than bpf_bt_sync_linked_regs() can propagate precision to.\nCollect the linked registers before the snapshots are taken instead.\nThis might lead to some unnecessary clear_scalar_id's, but from\nprevious testing situations with many linked registers are\nextremely rare.", "A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) verifier. A local user with permissions to load BPF programs could exploit this vulnerability to achieve privilege escalation or cause a denial of service (DoS). The issue stems from improper handling of register states during conditional jump evaluations, where the verifier mistakenly restores discarded register identifiers and tracks value ranges incorrectly. By submitting a specially crafted BPF program, an attacker can bypass safety checks enforced by the kernel."], "name": "CVE-2026-98042", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98042\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98042\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98042.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ec1d77cb0ee98249142dcd0376d76e7a48ba0b31,e821ff19b8ef08255ff8d8234774ed814637e9bf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ec1d77cb0ee98249142dcd0376d76e7a48ba0b31,73a98f96811e2cb0f4210b1caa8cb322f92f2a2b)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,7.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T16:00:18.017196+00:00", "updated": "2026-09-30T14:00:07.503411+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-787"]}