CVE-2026-98869

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Infer zext_dst based on static register liveness analysis

As reported in the thread [1], the verifier's 32-bit operations zero

extension logic is broken. This logic is responsible for correct

semantics of 32-bit operations on s390 architecture.

According to BPF semantics, operation `w1 += 1` is supposed to zero

extend the upper half of the register `r1`. On s390 the JIT relies on

the verifier emitting explicit zero extension before such operations.

The verifier attempts to minimize the amount of zero extensions

inserted by tracking whether upper halves of the 64-bit registers are

ever used. Previously such tracking worked as follows:

- bpf_reg_state->subreg_def field was set by do_check_insn()

for each operation defining lower but not the upper halves

of the register.

- Whenever an operation reading the whole register was verified,

the verifier checked register's subreg_def and set

bpf_insn_aux_data->

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References