CVE-2026-98816

What it actually does

The vulnerability allows an overflow in the jump offset calculation during BPF instruction blinding, causing jumps to point beyond the program bounds and resulting in a kernel crash when JIT hardening is enabled.

Why it matters to the business

Systems running affected Linux kernels with BPF JIT hardening may experience unexpected crashes, leading to denial of service and potential disruption of services relying on eBPF.

How an attack unfolds

An attacker with the ability to load BPF programs can submit a specially crafted program that triggers the offset overflow during constant blinding under bpf_jit_harden=2, causing the kernel to crash upon execution.

How to fix it

Update the Linux kernel to a version containing the fix that returns -ERANGE when blinding would produce an out-of-range jump offset.

How to confirm the fix worked

Confirm the kernel version includes the bpf_jit_blind_insn range check; attempt to load a test program that previously triggered the overflow and verify it is rejected cleanly.

Typical attack path

1. Obtain capability to load unprivileged or privileged BPF programs
2. Craft a BPF program containing conditional jumps that will be blinded
3. Enable bpf_jit_harden=2
4. Load and execute the program to trigger the offset wrap and crash

How to detect it

Inspect kernel logs for oops/panic messages referencing bpf_jit_blind_insn or bpf_adj_branches around the time of unexpected reboots or service failures.

What your security team should do

• Prioritize kernel updates on all systems exposing BPF to untrusted users
• Review and reduce use of bpf_jit_harden=2 where not strictly required
• Monitor kernel logs for BPF-related oops or panics