CVE-2026-98631

What it actually does

The xsk_map_gen_lookup function generates a BPF bounds check using BPF_JMP_IMM on a u32 key against max_entries; sign-extension of the immediate causes any max_entries >= 0x80000000 to be treated as a value larger than any 32-bit key, allowing an out-of-range index to bypass the check and perform an out-of-bounds read past the xsk_map array.

Why it matters to the business

Systems relying on AF_XDP sockets with large XSK maps may experience kernel memory disclosure or crashes, increasing exposure on high-throughput networking hosts until patched; the issue is recent and has shown negligible exploitation activity so far.

How an attack unfolds

An attacker with the ability to create or influence an XSK map with max_entries at or above 0x80000000 supplies a crafted lookup key that triggers the incorrectly generated comparison; the sign-extended threshold allows the index to skip the bounds check, resulting in an out-of-bounds memory read that can be used for information disclosure.

How to fix it

Apply the upstream kernel fix that replaces BPF_JMP_IMM with BPF_JMP32_IMM in xsk_map_gen_lookup; rebuild and deploy updated kernels on all affected systems; prioritize hosts using AF_XDP sockets.

How to confirm the fix worked

Confirm the presence of the corrected comparison using BPF_JMP32_IMM in the xsk_map_gen_lookup function in the running kernel source or binary; test map creation and lookup with max_entries values both below and above 0x80000000 to verify bounds enforcement.

Typical attack path

1. Create or control an AF_XDP socket map configured with max_entries >= 0x80000000
2. Trigger xsk_map_gen_lookup via a map lookup operation from a BPF program or user-space XSK API call
3. Supply a key that would normally be rejected by the bounds check
4. Observe or exfiltrate data read from memory beyond the xsk_map array

How to detect it

Examine kernel audit logs and BPF verifier traces for anomalous map lookup behavior; look for XSK map allocations with unusually large entry counts followed by unexpected memory access patterns in crash dumps or eBPF tracing.

What your security team should do

• Inventory all Linux systems using AF_XDP or XSK maps and schedule kernel updates
• Monitor upstream stable and distribution kernels for the backported fix
• Apply updates within normal patch windows given low EPSS and absence from KEV
• Review any custom BPF programs that interact with XSK maps for additional hardening