CVE-2026-98041

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The attacker must load a BPF program locally with bpf(BPF_PROG_LOAD). bpf_check() -> check_cond_jmp_op() -> is_branch_taken() then mispredicts a JMP32 'if wX != 0' on a pointer register. No network peer supplies any of the input.

AC:HAttack complexity, high

The fall-through only diverges at runtime when the pointer's low 32 bits happen to be zero. An unprivileged attacker cannot read kernel addresses, so they cannot choose that alignment. That route also needs the non-default setting unprivileged_bpf_disabled=0 and a way past the verifier's unprivileged mitigations.

PR:LPrivileges required, low

For JMP32 compares of a pointer against immediate 0, is_branch_taken() runs before the 'pointer comparison prohibited' check, so unprivileged socket-filter programs reach it when kernel.unprivileged_bpf_disabled=0. That setting is non-default on current kernels but was upstream's default on older affected kernels. Otherwise CAP_BPF in init_user_ns is required.

UI:NUser interaction, none

The attacker writes, loads and runs the BPF program themselves, for example by attaching a socket filter to their own socket and sending traffic. No other user has to act.

S:UScope, unchanged

The result is a kernel privilege escalation inside the same kernel security authority. The bug does not cross a VM or hypervisor boundary.

C:HConfidentiality impact, high

Unverified code on the path the verifier thought unreachable can add an arbitrary scalar to a pointer the verifier believes is in bounds, for example the fix commit's r1 += r6 with r6=0xdead000000000000. The following load then reads arbitrary kernel memory.

I:HIntegrity impact, high

The same out-of-bounds pointer can be used as the target of a store, so the bypass gives an arbitrary kernel write and a path to code execution or credential overwrite.

A:HAvailability impact, high

Dereferencing the wild pointer on the mispredicted path, such as 0xdead000000000000 in the commit's reproducer, oopses or panics the kernel.