‹ Volver al listado

CVE-2026-98631

Estado: RecibidaSin puntuar—
Gravedad—Sin puntuar
Probabilidad de explotación0.21 %mayor que el 11 % de las CVE
Explotación activaNono figura en el catálogo de CISA
Exploit públicoNo conocidosin código público localizado

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:

xsk: Usar una comparación de 32 bits en xsk_map_gen_lookup

xsk_map_gen_lookup() carga una clave u32 y la compara con max_entries usando BPF_JMP_IMM. Los inmediatos de BPF se extienden con signo a 64 bits, por lo que un valor de max_entries de 0x80000000 o superior se convierte en un umbral mayor que cualquier clave de 32 bits extendida con ceros. Un índice fuera de rango omite entonces la comprobación de límites y la búsqueda generada lee más allá de xsk_map[].

Corregir la comparación con BPF_JMP32_IMM para que la comprobación se mantenga dentro del rango de 32 bits sin signo.

Traducción automática del texto original de NVD (en inglés).

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días
0.21 %
Percentil entre todas las CVEs puntuadas
11
Fecha de la puntuación
20/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

Mostrar las 8 referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-98631",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "e65650f291ee72fc578d6346080fc4699204ef2c",
              "lessThan": "c6d5c582d55a8f229d75e98d62eaa065b0deb18d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e65650f291ee72fc578d6346080fc4699204ef2c",
              "lessThan": "227ec890559e922e235eb543646e3bf0bd8269b0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e65650f291ee72fc578d6346080fc4699204ef2c",
              "lessThan": "11d9be35c1f4233798e99be98bc474f83a254c6c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e65650f291ee72fc578d6346080fc4699204ef2c",
              "lessThan": "123f90f394ca404ab8796a7c8072ff7fa5b65a9c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e65650f291ee72fc578d6346080fc4699204ef2c",
              "lessThan": "36461e58f88a1b723f86693f437ac12e60ff4363",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e65650f291ee72fc578d6346080fc4699204ef2c",
              "lessThan": "b5c0cff0c5331582ab01c4c423731453a8381acc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e65650f291ee72fc578d6346080fc4699204ef2c",
              "lessThan": "3c1e0a4bc156b8d5c5772dbc76b9ea74dce5ca24",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e65650f291ee72fc578d6346080fc4699204ef2c",
              "lessThan": "70504de0bb627848667207bec7ccfd647deb8814",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/xdp/xskmap.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.5",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.55",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.9",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/xdp/xskmap.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-10-18T16:17:16.180",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/11d9be35c1f4233798e99be98bc474f83a254c6c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/123f90f394ca404ab8796a7c8072ff7fa5b65a9c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/227ec890559e922e235eb543646e3bf0bd8269b0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/36461e58f88a1b723f86693f437ac12e60ff4363",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3c1e0a4bc156b8d5c5772dbc76b9ea74dce5ca24",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/70504de0bb627848667207bec7ccfd647deb8814",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b5c0cff0c5331582ab01c4c423731453a8381acc",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c6d5c582d55a8f229d75e98d62eaa065b0deb18d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: Use a 32-bit compare in xsk_map_gen_lookup\n\nxsk_map_gen_lookup() loads a u32 key and compares it with max_entries\nusing BPF_JMP_IMM. BPF immediates are sign-extended to 64 bits, so a\nmax_entries value of 0x80000000 or higher becomes a threshold larger\nthan every zero-extended 32-bit key. An out-of-range index then skips\nthe bounds check and the generated lookup reads past xsk_map[].\n\nCompare with BPF_JMP32_IMM so the check stays in 32-bit unsigned range."
    }
  ],
  "lastModified": "2026-10-19T10:19:27.347",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}