In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bounds check for skb-backed dynptrs The skb_pointer_if_linear()… (CVE-2026-98591)

The Linux kernel vulnerability (CVE-2026-98591) involves the skb_pointer_if_linear() function, which checks if a memory region within an skb (socket buffer) is in the linear area. The function's bounds check subtracts the offset from skb_headlen, both unsigned values, causing an underflow that allows the check to incorrectly pass. This results in returning an arbitrary pointer based on skb->data + offset. The only affected code is skb-backed BPF dynptrs, which may be erroneously backed by invalid memory due to this flaw. The fix ensures the subtraction cannot underflow and uses 64-bit arithmetic to prevent overflow in the calculation.

The vulnerability can cause skb-backed BPF dynamic pointers to reference invalid memory due to incorrect bounds checking. This may lead to memory safety issues within the kernel's BPF subsystem. No known exploits in the wild have been reported. The impact is limited to the skb-backed BPF dynptr code path.

A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel updates that include this patch. Since this is a kernel-level issue, updating to a patched kernel version is the recommended remediation.