{"cve":"CVE-2026-68295","nvd":{"published":"2026-08-10T13:20:18.940","modified":"2026-10-21T13:19:27.540","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: BPF: Zero-extend signed ALU32 div/mod results\n\nALU32 operations write a 32-bit result and leave the upper 32 bits of\nthe BPF register zero. The LoongArch JIT sign-extends the result of\nsigned ALU32 BPF_DIV and BPF_MOD (off=1), so a negative 32-bit quotient\nor remainder leaves bits 63:32 set in JITted code while the verifier\nand interpreter model those bits as zero.\n\nKeep sign-extension on the operands, which signed divide needs, and\nzero-extend the ALU32 result after the divide or modulo instruction,\nmatching the unsigned ALU32 div/mod paths and every other ALU32\noperation in this JIT.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":[],"references":["https://git.kernel.org/stable/c/16656c3d734693be3d8a36dbf9d09142b69f3ddc","https://git.kernel.org/stable/c/716cb29dbed4d62e9e108950a1a82bcba4cc2d45","https://git.kernel.org/stable/c/7577cca85f2d4590c9d9423ba72ef54181a713c9","https://git.kernel.org/stable/c/dacd348b8a993373576fe2ee2d8b114740ba57a6"],"products":[],"source":"nvd","synced_at":"2026-10-22T16:41:11.231219466+00:00"},"epss":{"cve":"CVE-2026-68295","score":0.00175,"percentile":0.06949,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}