Cloudanix VulnDB

CVE-2026-98572

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A coding mistake in the Linux kernel's networking engine on certain 32-bit MIPS processors can cause security checks to behave incorrectly until the kernel is updated.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Incorrect addu instruction emitted instead of addiu for immediate operands in BPF JMP JEQ/JNE on MIPS32 causes the constant 1 to be interpreted as register $at (BPF_REG_AX), producing invalid comparison results specifically when the immediate operand is negative.

Why it matters to the business

MIPS32 systems using eBPF for networking, security, or tracing may experience bypassed checks or crashes; low prevalence and no known exploitation keep operational risk limited but require prompt patching of affected kernels.

How an attack unfolds

An attacker loads a crafted BPF program containing a negative immediate in a JEQ or JNE instruction; the miscompiled addu treats the value as a register reference, causing the comparison to evaluate incorrectly and allowing unintended control flow or data access.

How to fix it

Apply the upstream kernel commit that replaces addu with addiu for immediate-form JMP instructions on MIPS32; rebuild and deploy the corrected kernel image on all MIPS32 systems.

How to confirm the fix worked

Confirm the fix by running test_bpf on MIPS32 hardware or QEMU, verify the emitted JIT code contains addiu for the affected instructions, and ensure no regression in BPF comparison tests.

Typical attack path

  1. Identify MIPS32 target running unpatched kernel with BPF JIT enabled
  2. Craft and load BPF program using negative immediate in JEQ/JNE
  3. Trigger program execution path that exercises the faulty comparison
  4. Observe bypassed security decision or kernel misbehavior

How to detect it

Review kernel logs for BPF JIT compilation messages on MIPS32; inspect loaded BPF programs for negative immediates in JEQ/JNE; no post-exploitation artifacts are known because the issue was resolved before public exploitation.

What your security team should do

  • Inventory all MIPS32 Linux systems and identify those using eBPF
  • Prioritize kernel upgrade on any exposed or security-sensitive MIPS32 devices
  • Disable BPF JIT on MIPS32 if immediate patching is delayed
  • Monitor for future BPF JIT fixes in the same architecture family

The record

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix immediate JMP JEQ/JNE on MIPS32 An addu instruction was emitted instead of addiu, causing the immediate value 1 to be interpreted as register $at. This made the comparison result invalid when the immediate operand was negative. Note that $at is mapped to BPF_REG_AX, which is used for constant blinding. Fix the instruction to use the immediate form. Found with test_bpf on MIPS32r1 emulated by QEMU.

Affected packages

Ecosystem Package Introduced Fixed