In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpf_sock context code generation Currently, the ctx access code reads… (CVE-2026-98590)

The vulnerability in the Linux kernel's BPF sock context code generation arises from the ctx access code reading the rx_queue_mapping field with either a 4-byte or 2-byte load, while the verifier marks the rest of the bits as zero. However, the emitted code uses a 64-bit immediate move (BPF_MOV_IMM64) to place a special value (-1) in the register, which is sign-extended and turns on all bits. This causes the runtime value to exceed what the verifier assumes possible, potentially leading to incorrect behavior. The fix replaces the 64-bit move with 32-bit move instructions (MOV32) to keep upper bits zero and correctly reports the size of the destination variable as 4 bytes instead of 2 bytes.

The vulnerability could cause the BPF program to operate on values outside the verifier's expected range, potentially leading to incorrect program behavior or logic errors within the kernel's BPF subsystem. No known exploits in the wild have been reported. The impact is limited to the kernel's BPF sock context code generation and does not indicate direct privilege escalation or denial of service from the provided data.

A fix has been implemented to address this vulnerability by correcting the code generation to use 32-bit move instructions and properly report variable sizes. Users should update their Linux kernel to a version that includes this fix once it is released. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.