{"cve":"CVE-2026-98631","nvd":{"published":"2026-10-18T16:17:16.180","modified":"2026-10-19T10:19:27.347","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: Use a 32-bit compare in xsk_map_gen_lookup\n\nxsk_map_gen_lookup() loads a u32 key and compares it with max_entries\nusing BPF_JMP_IMM. BPF immediates are sign-extended to 64 bits, so a\nmax_entries value of 0x80000000 or higher becomes a threshold larger\nthan every zero-extended 32-bit key. An out-of-range index then skips\nthe bounds check and the generated lookup reads past xsk_map[].\n\nCompare with BPF_JMP32_IMM so the check stays in 32-bit unsigned range.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/11d9be35c1f4233798e99be98bc474f83a254c6c","https://git.kernel.org/stable/c/123f90f394ca404ab8796a7c8072ff7fa5b65a9c","https://git.kernel.org/stable/c/227ec890559e922e235eb543646e3bf0bd8269b0","https://git.kernel.org/stable/c/36461e58f88a1b723f86693f437ac12e60ff4363","https://git.kernel.org/stable/c/3c1e0a4bc156b8d5c5772dbc76b9ea74dce5ca24"],"products":[],"source":"nvd","synced_at":"2026-10-19T23:00:53.604569364+00:00"},"epss":{"cve":"CVE-2026-98631","score":0.0021,"percentile":0.11157,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}